The article describes a detection engineering technique developed by Elastic's internal InfoSec team that uses ES|QL COMPLETION (an LLM-invoking query command) to triage curl and wget process execution alerts (mapped to MITRE ATT&CK T1105, Ingress Tool Transfer) after deterministic allow-list filtering and secret redaction. In a 7-day production test, only three destinations survived filtering, and LLM triage correctly classified all three without generating an analyst-facing false positive, demonstrating a hybrid deterministic+LLM approach to reduce alert fatigue on noisy cloud detection rules.
ES|QL COMPLETION
1 post
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts