Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which alert status indicates that an analyst has viewed the alert but has not yet finished working on it?

   • AAcknowledged
   • BClosed
   • CIn progress
   • DOpen
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does the Detection Engine use scheduled queries to search activity?

   • AIt sends the query to external threat intelligence feeds for analysis
   • BIt converts the query into a machine learning model for anomaly detection
   • CIt stores the query in a queue and runs it only when the cluster is idle
   • DIt runs the rule's query at defined intervals against the specified indices
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A detection rule is configured to generate an alert when a specific file hash is observed. The rule runs every 15 minutes. An analyst is investigating an alert and wants to know when the alert was created. Where can the analyst find this information?

   • AIn the Elasticsearch index where the alert is stored, but only if the analyst has access to the raw index.
   • BIn the alert's details, which include the timestamp of when the alert was generated.
   • CIn the Kibana dashboard, but only if the analyst has created a custom visualization.
   • DIn the rule's configuration, which shows the last execution time.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC team wants to detect multiple failed login attempts from the same source IP within a 10-minute window. They currently have a query rule that triggers on each failed login event. Which rule type should they use to reduce alert noise and generate a single alert when the threshold is met?

   • AMachine learning rule
   • BCorrelation rule
   • CThreshold rule
   • DQuery rule
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is investigating an alert that was generated by a detection rule. The analyst has confirmed that the alert is a false positive and wants to prevent it from cluttering the active alerts view, but still wants to keep a record of the investigation. What should the analyst do?

   • AChange the rule's severity to low.
   • BAcknowledge the alert and leave it open.
   • CDelete the alert from the system.
   • DClose the alert with a reason of 'False positive'.
   Reveal Solution Discussion Select an answer first