Elastic tested ES|QL COMPLETION in curl and wget rules to filter benign cloud activity before alerts. In 7 days, only 3 wget destinations survived filtering, all were triaged by the LLM, and none reached analysts. #ESQL_COMPLETION #curl #wget
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts
Elastic tested ES|QL COMPLETION on noisy curl and wget detection rules in cloud environments to filter benign activity before alerts reached analysts. In a seven-day wget evaluation, only three destinations survived deterministic filtering, all were triaged by the LLM, and none produced analyst-opened alerts, helping preserve trust in detections for cases like ingress tool transfer. #ESQL_COMPLETION #curl #wget #ElasticCloudServerless #Auditbeat
www.hendryadrian.com
July 25, 2026 at 1:15 AM
Elastic tested ES|QL COMPLETION in curl and wget rules to filter benign cloud activity before alerts. In 7 days, only 3 wget destinations survived filtering, all were triaged by the LLM, and none reached analysts. #ESQL_COMPLETION #curl #wget