1.1 Elastic Certified SIEM Analyst Exam Facts, Objectives & Study Plan

Quick Answer: The Elastic Certified SIEM Analyst exam is a timed, cognitive (knowledge-based) exam about the Elastic Security solution, based on Elastic Stack 8.15. It costs $400 USD per attempt, is taken online with remote proctoring, and Elastic's exam page lists a 2-hour duration. The credential is valid for 2 years. Elastic does not publish the number of questions, the passing score or domain weights.

Before studying any feature, know exactly what Elastic measures and how the exam runs. Every fact below comes from Elastic's exam page and Certification FAQ (checked September 2026). Recheck them before you buy an attempt, because Elastic can change prices and policies.

What Kind of Exam Is It?

Elastic runs two styles of certification exam. The Elastic Certified Engineer, Observability Engineer and Analyst exams are performance-based: you complete live tasks on a cluster while a proctor watches. The SIEM Analyst exam is different. It is a timed cognitive-based exam in which you answer:

• Multiple choice questions
• Select all that apply questions
• Fill in the blanks questions
• True or false questions

All of them center on the Elastic Security solution. You will not build a detection rule on a live cluster during the exam. You will be asked which feature, setting, query or workflow achieves a result, and why. That is why this guide stresses exact feature names, defaults, limits and the differences between similar tools.

Exam Facts at a Glance

Scheduling Rules That Can Cost You an Attempt

• You can reschedule up to 24 hours before your self-scheduled time.
• You must start within 30 minutes of your scheduled time. Otherwise you are marked a no-show and forfeit the attempt.
• If ID verification fails, contact the proctor through Honorlock chat rather than leaving the exam. No refunds or reschedules are given for an invalid or missing ID.
• A US keyboard (or the on-screen keyboard) is recommended for special characters such as { }. DeepL translation is available inside the exam environment, and extra time for translation can be requested from certification@elastic.co 3–5 business days in advance.

Keeping the Credential

The certification is valid for 2 years from the exam date. To renew, pass an Elastic certification exam before it expires, which extends an active certification by two years. Extensions are not available for expired certifications.

The Official Exam Objectives

Elastic states that candidates should be able to complete all of the following objectives with only the assistance of the Elastic documentation. The table maps each objective to this guide.

Two chapters give supporting context. Chapter 13 covers spaces, privileges and Elastic Defend administration, and Chapter 14 follows the threat-hunting capstone that ends Elastic's training course.

Recommended Preparation

Elastic's exam page recommends the Elastic Security for SIEM course, a 24-hour course whose lessons follow the objectives above: Stack overview, ECS, Discover, Visualizations, Dashboards, Security App, and a Hunt capstone. The virtual instructor-led version is listed at $2,700 USD. Elastic also offers an Elastic Security for SIEM Self-Paced Learning Plan. Elastic Training Subscription holders get one exam and one practice exam per solution during the subscription term.

The course assumes a basic understanding of:

• Networking: TCP/IP, common ports and protocols, routers, switches and firewalls
• Network monitoring tools: IDS (Suricata), Zeek and packet capture
• Operating systems: Windows and Linux, file systems and permissions, command-line navigation
• Attack methodology: reconnaissance, command and control (C2) and data exfiltration

A Practical Study Plan

Exam-Day Strategy

1. Read for the version. The exam targets 8.15, and several features changed later. For example, in 8.15 Attack Discovery is a technical preview and prebuilt rules can't be edited beyond actions and exceptions.
2. Watch for "select all that apply." Evaluate every option on its own merits rather than stopping at the first correct one.
3. Separate look-alike features. Common traps include exceptions vs. alert suppression, trusted applications vs. event filters, KQL vs. EQL vs. ES|QL syntax, and Cases vs. Timeline.
4. Use the documentation deliberately. Know where the Elastic Security docs cover rules, alerts and Timeline, so a lookup takes seconds rather than minutes.
5. Budget your time. With 2 hours and an unpublished question count, move on from hard items and come back.