The article describes a detection engineering technique developed by Elastic's internal InfoSec team that uses ES|QL COMPLETION (an LLM-invoking query command) to triage curl and wget process execution alerts (mapped to MITRE ATT&CK T1105, Ingress Tool Transfer) after deterministic allow-list filtering and secret redaction. In a 7-day production test, only three destinations survived filtering, and LLM triage correctly classified all three without generating an analyst-facing false positive, demonstrating a hybrid deterministic+LLM approach to reduce alert fatigue on noisy cloud detection rules.
Alert Fatigue
3 posts
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts Your Security Program Was Built for a Threat Landscape That No Longer Exists A recent Huntress survey reveals that modern security teams struggle primarily with alert fatigue and a shifting threat landscape rather than budget constraints. Organizations are increasingly vulnerable to identity-based attacks such as business email compromise and session hijacking, necessitating a strategic pivot from traditional endpoint-centric prevention to Identity Threat Detection and Response (ITDR) supported by AI.
Prioritizing Alerts Triage with Higher-Order Detection Rules Elastic outlines the methodology and operational benefits of Higher-Order Rules (HOR), which correlate atomic security alerts across entities, data sources, and timeframes. By aggregating signals from endpoints, network devices, and observability metrics, HORs significantly reduce alert fatigue and surface high-confidence malicious activity for prioritized SOC triage.
