Tool Path
Elastic Security
Investigate logs with the Elastic Stack and KQL. Learn indices, documents and fields, write Kibana Query Language to search and filter, aggregate with visualizations, and correlate an incident in Elastic Security — the same analyst reasoning as Splunk, in a second language.
Curriculum
- 01Available
Elastic Security & the Stack
What the Elastic Stack is (Elasticsearch + Kibana), how it stores log data as JSON documents with fields inside indices, and how you explore it in Discover across a chosen time range.
- 02Available
Searching with KQL
Kibana Query Language end to end: field:value, free text, boolean AND/OR/NOT with grouping, wildcards, numeric and date ranges, and exists — the precise way to select events.
- 03Available
Aggregations and Visualizations
Turn documents into answers with aggregations: count and unique count (cardinality), the terms aggregation for top values, and the date histogram to see a pattern over time.
- 04Available
Investigating in Elastic Security
Work an incident: read the Alerts table, use Timeline to correlate events from several sources on a shared key, understand how a detection rule fired, and reach a defensible verdict.