Resources: LLM

Correlated Alerts on Similar User Identities

Jul 31, 2026 · Domain: Identity Domain: LLM Use Case: Threat Detection Use Case: Identity and Access Audit Resources: Investigation Guide Resources: LLM Rule Type: Higher-Order Rule ·

Share on:

This rule correlates alerts from multiple integrations and event categories that involve different user.name values which may represent the same real-world identity. It uses an LLM-based similarity analysis to evaluate whether multiple user identifiers (e.g. naming variations, formats, aliases, or domain differences) likely belong to the same person.

LLM-Based Attack Chain Triage by Host

Jul 31, 2026 · Domain: Endpoint Domain: LLM Use Case: Threat Detection Data Source: Elastic Defend Resources: Investigation Guide Resources: LLM Rule Type: Higher-Order Rule ·

Share on:

This rule correlates multiple endpoint security alerts from the same host and uses an LLM to analyze command lines, parent processes, file operations, DNS queries, registry modifications, module loads and MITRE ATT&CK tactics progression to determine if they form a coherent attack chain. The LLM provides a verdict (TP/FP/SUSPICIOUS) with confidence score and summary explanation, helping analysts to prioritize hosts exhibiting corroborated malicious behavior while filtering out benign activity.

LLM-Based Compromised User Triage by User

Jul 31, 2026 · Domain: Identity Domain: LLM Use Case: Threat Detection Use Case: Identity and Access Audit Resources: Investigation Guide Resources: LLM Rule Type: Higher-Order Rule ·

Share on:

This rule correlates multiple security alerts involving the same user across hosts and data sources, then uses an LLM to analyze whether they indicate account compromise. The LLM evaluates alert patterns, MITRE tactics progression, geographic anomalies, and multi-host activity to provide a verdict and confidence score, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.

LLM-Based Curl Activity Triage

Jul 31, 2026 · Domain: Endpoint Domain: LLM OS: Linux OS: macOS OS: Windows Use Case: Threat Detection Tactic: Collection Tactic: Command and Control Tactic: Exfiltration Data Source: Elastic Defend Resources: Investigation Guide Resources: LLM ·

Share on:

Detects non-allowlisted curl activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Curl Activity Triage via Auditd

Jul 31, 2026 · Domain: Endpoint Domain: LLM OS: Linux Use Case: Threat Detection Tactic: Collection Tactic: Command and Control Tactic: Exfiltration Data Source: Auditd Manager Resources: Investigation Guide Resources: LLM ·

Share on:

Detects non-allowlisted curl activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Wget Activity Triage

Jul 31, 2026 · Domain: Endpoint Domain: LLM OS: Linux OS: macOS OS: Windows Use Case: Threat Detection Tactic: Collection Tactic: Command and Control Tactic: Exfiltration Data Source: Elastic Defend Resources: Investigation Guide Resources: LLM ·

Share on:

Detects non-allowlisted wget activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Wget Activity Triage via Auditd

Jul 31, 2026 · Domain: Endpoint Domain: LLM OS: Linux Use Case: Threat Detection Tactic: Collection Tactic: Command and Control Tactic: Exfiltration Data Source: Auditd Manager Resources: Investigation Guide Resources: LLM ·

Share on:

Detects non-allowlisted wget activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.