Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   Which statement best describes how the Detection Engine operates in relation to time?

   • AIt only processes data that is older than 24 hours to avoid performance impact
   • BIt operates in batch mode once per day to generate daily summary reports
   • CIt continuously evaluates activity as new data is ingested, and also runs scheduled searches at defined intervals
   • DIt runs only when a security analyst manually triggers a search from the UI
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is designing a detection strategy. They need to detect a single suspicious command execution, as well as a series of events that indicate a multi-stage attack. They want to minimize the number of rules to manage. What is the most efficient approach?

   • AUse a threshold rule for both detections.
   • BUse a single correlation rule that covers both the single command and the multi-stage attack.
   • CUse a query rule for the single command and a correlation rule for the multi-stage attack.
   • DUse a machine learning rule for both detections.
   Reveal Solution Discussion Select an answer first