Add ES|QL COMPLETION-based triage examples for curl and wget activity, giving defenders a focused companion pack for LLM-assisted command-and-control investigation in Elastic Security.
What is included
- Elastic Defend and Auditd variants for curl activity LLM triage.
- Elastic Defend and Auditd variants for wget activity LLM triage.
- Elastic License 2.0 and NOTICE files from the upstream detection-rules repository.
Who it helps
This pack is aimed at detection engineers and SOC teams exploring when LLM-assisted triage can add value after deterministic filtering. The rules aggregate curl or wget behavior by host and destination, redact common secrets, and then use ES|QL COMPLETION to produce a triage result.
Compatibility
The included rule metadata states that ES|QL COMPLETION and INLINE STATS require Elastic Stack 9.3.0 or later. The draft has been tagged as 9.3 compatibility.
Operational notes
Review inference costs, data-handling requirements, and the Elastic Inference Service model configuration before enabling these rules. LLM triage should complement analyst review, not replace validation of the underlying events.
Source and license
Source: elastic/detection-rules cross-platform rules. The upstream repository uses Elastic License 2.0, and the license and notice files are included in the ZIP.
| Tested versions | 9.3 |
| ECS compliant | |
| Tested versions |
You must log in to submit a review.