How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts

Keypoints

• Elastic’s InfoSec team used ES|QL COMPLETION inside curl and wget detection rules to triage noisy process events before they became analyst-facing alerts.
• The approach parses the destination host from command-line arguments, applies deterministic allow-lists, redacts secrets, aggregates survivors, and then asks an LLM for a verdict.
• The rules are designed to keep file-transfer detections enabled in cloud environments where curl and wget are heavily used for packages, CI jobs, metadata requests, and automation.
• MITRE ATT&CK T1105 Ingress Tool Transfer is directly relevant because attackers often use curl and wget to move payloads into victim environments.
• Elastic recommends anchoring filtering on parsed destination hosts rather than raw command lines to avoid brittle substring matches and false exceptions.
• The seven-day wget test in a QA Discover session produced only three surviving destinations; two were judged FP and one SUSPICIOUS, with no analyst-opened alert from the full set.
• The article emphasizes that deterministic filtering should happen first, with LLM triage reserved for ambiguous cases to reduce queue noise and preserve analyst trust.