ESQL COMPLETION curl/wget Triage Rules
Elastic Security rules that use ES|QL COMPLETION to triage curl and wget activity after deterministic filtering and aggregation.
Use this collection
What you can do with Security Labs Companion Packs downloads
Security Labs Companion Packs resources support security monitoring, detection engineering, alert triage, and investigation workflows for teams using Elastic Security and the Elastic Stack.
How should I use these examples?
Download the content, import it into your Elastic environment, review the saved objects or rules, and adapt the fields, filters, and visualizations to your own data.
Where should I go next?
Use the related collections below to move between dashboards, security content, observability examples, pipelines, Elasticsearch resources, and AI-assisted Elastic workflows.
Explore Elastic content
Start from a use case, solution area, or content type to find useful Elastic resources.
End-to-End Observability
Business Critical Service health across UX, CDN, origin, network, and platform—including async hops without a single shared trace.
Kubernetes Observability
Kubernetes monitoring, OpenTelemetry, SLO, EKS, and ECK resources for Elastic users.
Network Observability
Packetbeat, DNS analytics, network signals, and observability patterns for Elastic.
Telco industry
Telco-focused paths for network visibility, service reliability, Kubernetes, and security monitoring.
Kibana dashboards
Ready-to-use dashboard examples for visualizing Elasticsearch data.
Security Labs Companion Packs downloads
More about Security Labs Companion Packs
Reusable rules, queries, hooks, and configs that accompany Elastic Security Labs research.