Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   An analyst is reviewing alerts and finds one that was closed, but new evidence suggests the alert was actually a true positive and requires further investigation. What should the analyst do to continue working on the alert?

   • ACreate a new alert manually.
   • BReopen the alert.
   • CChange the alert's severity.
   • DAcknowledge the alert.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does a detection rule's 'index pattern' specify?

   • AThe schedule at which the rule runs its search query
   • BThe list of users who are allowed to view the rule's alerts
   • CThe severity level assigned to alerts generated by the rule
   • DThe Elasticsearch indices that the rule searches for matching events
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   An analyst is working on an alert that has been acknowledged. The analyst has completed the investigation and determined that the alert is a true positive, but the issue has been resolved. What should the analyst do to reflect this in the alert's lifecycle?

   • ALeave the alert as acknowledged.
   • BClose the alert with a reason of 'True positive'.
   • CChange the alert's severity to low.
   • DReopen the alert to start a new investigation.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the typical final status in the alert lifecycle after an analyst has resolved an investigation?

   • AAcknowledged
   • BDeleted
   • CClosed
   • DOpen
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC manager is evaluating the Detection Engine's ability to handle a high volume of rules and frequent schedules. The team has 200 rules, each running every 5 minutes. They are concerned about the load on the Elasticsearch cluster and want to ensure the Detection Engine can keep up. What is the most important factor to consider?

   • AThe severity levels configured for the rules
   • BThe number of shards and the size of the indices being searched
   • CThe time zone settings of the Elasticsearch cluster
   • DThe number of alerts generated by each rule
   Reveal Solution Discussion Select an answer first