Elastic Certified SIEM Analyst

Last checked November 10, 2026 against the official Elastic exam page.

1. Question 1Stack Architecture

   A team wants one lightweight agent on each Windows server that collects logs and metrics and is enrolled and updated from Kibana, instead of editing configuration files by hand on every host. Which approach fits this requirement?

   1. AInstall Kibana on each server and use Saved Objects
   2. BInstall Logstash on each server and edit its pipeline files
   3. CInstall a separate Elasticsearch node on each server
   4. DInstall Elastic Agent and enroll it with Fleet
   Show answer and explanationHide answer

   Correct answer: D

   Elastic Agent is a single agent that runs integrations and is enrolled and managed centrally through Fleet in Kibana, so policy changes need no file edits on each host. Kibana is the user interface and does not collect host data, Logstash is a server-side transformation pipeline rather than a per-host collector, and an extra Elasticsearch node adds storage without collecting anything.

2. Question 2Elastic Common Schema (ECS)

   A custom log source writes the remote address of each connection into a field named dst_ip, while other sources store it in destination.ip. The SOC wants one correlation rule and one dashboard to cover all sources. What should the team do?

   1. AKeep dst_ip as it is and build a separate dashboard for it
   2. BMap the field to destination.ip, the name other sources use
   3. CChange the field type to text so partial address matches work
   4. DMove the value into the tags array so it is searchable everywhere
   Show answer and explanationHide answer

   Correct answer: B

   Mapping to destination.ip gives every source the same field name and type, so one rule and one dashboard can cover them. A separate dashboard leaves the data inconsistent, changing to text breaks IP-aware range and CIDR queries, and tags are free-form labels rather than structured values.

3. Question 3Discover

   An analyst wants only process events where process.name is powershell.exe and host.name starts with web. Which query fits Discover's query bar using KQL?

   1. Aprocess.name : "powershell.exe" and host.name : web*
   2. Bprocess.name = "powershell.exe" AND host.name LIKE "web%"
   3. Cprocess.name : powershell.exe or host.name : web*
   4. Dprocess.name == powershell.exe && host.name like web%
   Show answer and explanationHide answer

   Correct answer: A

   KQL uses field : value pairs, quotes for an exact phrase, an asterisk for wildcards and lowercase and for combining conditions, so this query returns the intended events. The first two use operators such as ==, = and LIKE that KQL does not accept, and the third joins the conditions with or where the scenario needs and.

4. Question 4Visualizations

   A SOC lead wants a bar chart of the ten source IP addresses with the most failed authentication events. Which aggregation setup fits?

   1. ADate histogram on @timestamp with an average metric
   2. BCardinality metric that counts unique values of source.ip
   3. CAverage metric on event.duration across all documents
   4. DTerms bucket on source.ip sorted by document count
   Show answer and explanationHide answer

   Correct answer: D

   A terms bucket groups documents by distinct source.ip values and sorts them by count, which gives the top sources. A date histogram groups by time rather than by address, cardinality counts unique values without ranking them, and an average of event.duration measures something unrelated to which addresses fail most.

5. Question 5Dashboards

   A SOC wants analysts to switch one dashboard between hosts by picking from a dropdown, and the choice should apply to every panel that uses the host field. What should be added to the dashboard?

   1. AA markdown panel that lists the available hosts
   2. BAn options list control on host.name
   3. CA separate copy of the dashboard for each host
   4. DA fixed host filter typed into each panel's visualization
   Show answer and explanationHide answer

   Correct answer: B

   An options list control on host.name gives a dropdown that filters every panel using that field, so viewers can switch hosts without editing anything. A markdown panel only displays text, copies per host multiply maintenance work, and fixed filters inside each panel cannot be changed by viewers.