Accelerating Elastic detection tradecraft with LLMs

Elastic Security Labs outlines internal R&D efforts to apply generative AI to detection engineering, including experiments that convert Elastic events into EQL queries and a “Rulecraft” system that rapidly generates standardized investigation guides for 900+ rules using prompt chaining, similarity search, and vector databases. Conducted during ONWeek and leveraging Azure OpenAI, LangChain, and GitHub Actions, the work accelerated content creation and workflow integration; next steps include comparing proprietary and OSS models, refining prompts and event filtering, establishing validation test suites to prevent regressions, and integrating capabilities into the Elastic AI Assistant.