A security analyst finds that the default alert list is cluttered with low-severity alerts that are not relevant to the team's current focus. The analyst wants to reduce noise and make the Alerts page more useful for daily triage. What should the analyst do?

Create a saved filter or view that excludes low-severity alerts and set it as the default

Change the alert status to 'Closed' for all low-severity alerts

Disable all detection rules that generate low-severity alerts

Manually close each low-severity alert every day

Which of the following can be attached to a security case?

Machine learning job configurations

What is the primary purpose of a security case in the Security App?

To store raw log data for long-term retention

To collaborate on an investigation and track response actions

To display network topology maps

An analyst is investigating a suspicious login from a user account. The analyst wants to see all events associated with that user, including authentication logs and any related alerts, without leaving the Security App. Which navigation approach should the analyst use?

Go to the Alerts page and filter by the username in the search bar

Create a new Timeline and manually add the username as a filter

Open the Users page, search for the username, and review the user's details and associated events

Navigate to the Hosts page and look for the user's host

What is the primary use of the Timeline feature in the Security App?

To configure data ingestion pipelines

To investigate events and correlate data across multiple sources

To create and manage detection rules

ElasticCertified SIEM Analyst

Domain 6Objective 1

Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

35questions here

7free pages

10concepts

Questions 21–25

21application · medium
A security analyst finds that the default alert list is cluttered with low-severity alerts that are not relevant to the team's current focus. The analyst wants to reduce noise and make the Alerts page more useful for daily triage. What should the analyst do?
Select an answer first
22foundation · easy
Which of the following can be attached to a security case?
Select an answer first
23foundation · easy
What is the primary purpose of a security case in the Security App?
Select an answer first
24application · medium
An analyst is investigating a suspicious login from a user account. The analyst wants to see all events associated with that user, including authentication logs and any related alerts, without leaving the Security App. Which navigation approach should the analyst use?
Select an answer first
25foundation · easy
What is the primary use of the Timeline feature in the Security App?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.