Embedding Security in LLM Workflows: Elastic's Proactive Approach

Elastic Labs demonstrates a proof-of-concept approach to audit and detect malicious LLM activity by proxying LLM requests, enriching logs with security analysis (LLM-Guard, LangKit, Rebuff, etc.), indexing to Elasticsearch, and creating ES|QL detection rules for threats like prompt injection, insecure output handling, model DoS, and sensitive information disclosure. The write-up includes a Flask proxy example, enrichment function pseudocode, sample detection queries, and recommendations for production alternatives (APM, OpenTelemetry, ECS normalization).