From plain English to production rule: AI-native Elasticsearch ES|QL detection in Elastic Security

Elastic Security introduces an AI-powered rule creation feature that converts plain-English threat descriptions into validated ES|QL detection rules (including MITRE ATT&CK mappings, severity recommendations, and live previews). The post demonstrates the workflow with an Okta credential-stuffing and account-takeover example, showing how the AI agent constructs multistage aggregation queries, allows iterative refinements, and previews results against real data; it is a product feature walkthrough and guidance for detection engineers, not an incident report.