How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts

This article documents a detection-engineering approach using Elastic ES|QL's COMPLETION feature (LLM inference) to triage noisy `curl` and `wget` process detections: parse and anchor destination hosts, apply deterministic allow-lists, redact secrets, aggregate by host/destination, cap rows, and ask an LLM for a structured verdict to reduce false positives and keep alerts meaningful; includes implementation examples, prompt guidance, and a seven-day QA test.