Preparing the data as we described previously was fundamental to being able to properly analyze the data with Elastic ML and reveal the steps of an attack. In this section, we will go through an investigation scenario of a DNS exfiltration attack and leveraging the anomalies that are detected by using Elastic ML to guide the analyst in the process.