PECB CourseTechnical CybersecurityAdvancedCertified Elastic Stack Analyst (CESA)
Master the Elastic Stack for security monitoring, threat detection, and security analytics.
Course Description
This course develops expertise in using the Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) for security analysis and monitoring. Learn to deploy, configure, and operate Elastic Security for threat detection, investigation, and security analytics at scale. Coming Soon.
Who Should Attend
- Security analysts using Elastic Stack
- SIEM engineers and administrators
- SOC analysts working with Elastic Security
- Data engineers supporting security operations
Learning Objectives
- 1Deploy and configure Elastic Stack for security use cases
- 2Create detection rules and alerts in Elastic Security
- 3Build security dashboards and visualizations in Kibana
- 4Investigate security incidents using Elastic Stack tools
- 5Optimize Elastic Stack performance for security analytics
Prerequisites
- Basic understanding of SIEM concepts and log analysis
- Familiarity with Linux and command-line tools
Course Modules
Day 1: Elastic Stack Architecture and Deployment
Elasticsearch cluster architecture; Logstash pipeline configuration; Kibana setup and management; Beats agents (Filebeat, Winlogbeat, Packetbeat, Auditbeat); deployment strategies (on-premises, cloud, hybrid); and index lifecycle management.
Day 2: Data Ingestion, Parsing, and Normalization
Log source integration and onboarding; Logstash filter plugins (grok, dissect, mutate); Elastic Common Schema (ECS); ingest node pipelines; field mapping and enrichment; and data quality management.
Day 3: Elastic Security Configuration and Detection
Elastic Security app setup; prebuilt detection rules; custom rule creation (KQL, EQL, threshold); machine learning anomaly detection jobs; indicator match rules; alert management and case workflows.
Day 4: Security Analysis, Investigation, and Threat Hunting
Timeline investigation interface; case management workflows; Elastic Security analyst guides; threat hunting with KQL and EQL; MITRE ATT&CK integration; osquery integration; and threat intelligence feeds.
Day 5: Dashboards, Reporting, and Certification Exam
Building security dashboards in Kibana; Lens and Canvas visualizations; KPI tracking and reporting; alerting and notifications; Elastic Stack performance optimization; cluster monitoring; and the certification exam.
Exam Details
Duration
3 hours
Format
Multiple choice (80 questions), open book
Passing Score
70%
Retake Policy
Free retake within 12 months after first failure
Available in:
Certification
PECB Certified Elastic Stack Analyst
Issued by PECB
Digital Badge & Verification
Verified via Credly
Upon passing the exam, your certificate will be issued as a digital badge via Credly. This badge can be shared on LinkedIn, embedded in your email signature, and verified by anyone at any time.
Share this course
Related Courses
Continue your learning journey with these related courses.
Certified Lead Ethical Hacker
Technical Cybersecurity
Master ethical hacking techniques and lead penetration testing engagements using PTES and OSSTMM methodologies.
Certified Cyber Threat Analyst
Technical Cybersecurity
Develop expertise in cyber threat analysis and threat hunting using MITRE ATT&CK, Diamond Model, and industry tools.
Certified Incident Responder
Technical Cybersecurity
Develop advanced incident response skills covering ransomware, malware analysis, and perimeter threat detection.