--- title: QL COMPLETION: LLM triage for noisy detection rules —... description: ES|QL COMPLETION integrates LLM triage directly into noisy curl and wget detection rules to reduce analyst alert fatigue. The approach uses a layered pipeline:... canonical: https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs | daily.dev og:description: ES|QL COMPLETION integrates LLM triage directly into noisy curl and wget detection rules to reduce analyst alert fatigue. The approach uses a layered pipeline:... og:url: https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w og:image: https://api.daily.dev/og/posts/JwgP8Qe5W.png og:image:alt: QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 17 min read · 0 upvotes · 0 comments ## Summary ES|QL COMPLETION integrates LLM triage directly into noisy curl and wget detection rules to reduce analyst alert fatigue. The approach uses a layered pipeline: deterministic allow-lists filter known-good destinations first, secrets are redacted from command lines before the LLM sees them, then surviving events are aggregated and sent to an LLM for a structured verdict (TP/FP/SUSPICIOUS with confidence score). Only results above 0.7 confidence and marked TP or SUSPICIOUS generate alerts. Tested over seven days on Elastic's own cloud fleet, three destinations survived deterministic filtering and none required analyst intervention. The post includes full ES|QL rule code, prompt injection mitigations, secret redaction patterns, and guidance on when LLM triage is and isn't appropriate. Prebuilt rules are available in the elastic/detection-rules GitHub repository for Elastic Stack 9.3+. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don't Let the AI Find Your Bugs. Let It Judge Them.](https://daily.dev/posts/don-t-let-the-ai-find-your-bugs-let-it-judge-them--fpqkjl4lo) · Awesome Java Newsletter · 2 upvotes · 1 comments - [Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage](https://daily.dev/posts/behind-the-tags-how-elastic-siem-grades-1-781-detection-rules-on-noise-speed-and-threat-coverage-bqqdc4wkb) · Elastic Security Labs · 0 upvotes · 0 comments - [How to evaluate LLMs before production](https://daily.dev/posts/how-to-evaluate-llms-before-production-ps4g4zhbm) · GitHub Blog · 2 upvotes · 0 comments - [Turning Threat Intelligence into Executable Hunt Plans with Rapid7](https://daily.dev/posts/turning-threat-intelligence-into-executable-hunt-plans-with-rapid7-erjmihdwf) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [Using LLMs to Find and Prioritize Vulnerabilities Is No Easy Task](https://daily.dev/posts/using-llms-to-find-and-prioritize-vulnerabilities-is-no-easy-task-dtmgdglfx) · Dark Reading · 5 upvotes · 1 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#elk](https://daily.dev/tags/elk), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs","url":"https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w"},"datePublished":"2026-07-23T15:47:29.605Z","dateModified":"2026-07-23T16:55:16.376Z","description":"ES|QL COMPLETION integrates LLM triage directly into noisy curl and wget detection rules to reduce analyst alert fatigue. The approach uses a layered pipeline:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e0c1d40698ded3d7973f005f9739643?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e0c1d40698ded3d7973f005f9739643?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,elk,prompt-injection","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs"}]} ```