Learn
Using Elastic Security
Discover: where you'll spend most of your time
Every scenario gives you access to Elastic Security, and Discover is the screen you'll open first. It's the primary interface for exploring raw events: a search bar at the top, a time range picker next to it, and a table of matching documents below, each one expandable to see every field it contains.
The time range matters more than it might seem. Elastic defaults to showing you a recent window, and if you're investigating something that happened hours or days into a scenario, the first thing to check when your search returns nothing is whether you're even looking at the right window before you assume your query is wrong.
KQL: the query language you'll use constantly
The search bar speaks KQL, Kibana Query Language, and the syntax is simpler than it looks. The core pattern is field: value:
event.code: "4769"
That single line finds every Kerberoasting-relevant ticket request in the current time window, the same event you'd have read one instance of on the Reading the Telemetry page, now searchable across every host at once.
Combine fields with and, or, and not the way you'd expect:
process.parent.name: "winword.exe" and process.name: "powershell.exe"
That finds every case of Word spawning PowerShell, the exact pattern flagged as suspicious on the Reading the Telemetry page, searched for directly instead of noticed by chance while scrolling. Wildcards work too (process.name: powershell*), and you can search a field for existence alone (process.command_line: *) when you just want to know whether a field is populated at all.
This is the actual shift Discover gives you over reading events one at a time: instead of finding one suspicious event, you ask a specific question, across everything, at once.
Filters: pinned, not typed
Alongside the search bar, filters let you narrow results without rewriting your query every time. Click a value in the document table and choose "Filter for value" or "Filter out value," and it appears as its own pill above the search bar, separate from whatever's in the KQL box. This matters because filters and queries behave differently: a filter stays pinned while you change your search, so you can keep "host.name: WKSTN01" locked in place while you try several different queries against just that one host, without retyping the host filter each time.
The field list: a shortcut to what's actually there
The left sidebar lists every field present in your current results. Click one and Kibana shows a quick breakdown of its top values without writing any query at all, useful the moment you're not sure what's in a field yet, or want a fast sense of which values dominate before deciding what to search for specifically.
Where investigations actually get built
Discover is where you search. Once you're actually building an investigation, correlating multiple events into a narrative, adding notes, working across hosts, Elastic Security's Timeline is the dedicated workspace for that: drag events in directly from Discover, query within it using KQL or the more powerful ES|QL, and keep a running record of what you've found as you find it. Your First Investigation walks through exactly that, using everything from this page as the starting toolkit.
Where to go from here
You now know how to read an individual event and how to search across all of them. Your First Investigation puts both together: a full walkthrough, alert to conclusion, using Discover, filters, and Timeline the way an actual investigation actually uses them.
Where to go from here