Threat Intel
Elastic ES|QL COMPLETION Enables In‑Query LLM Reasoning for Detection Triage
Elastic has added the COMPLETION command to ES|QL, allowing detection engineers to embed LLM inference directly into query logic. This eliminates the need for external SOAR or scripts to add contextual reasoning to behavioral rules. Defenders can now build smarter alert triage within a single query, using Elastic Cloud models or external LLM connectors.
What Happened
Elastic released the ES|QL COMPLETION command, a new query operator that injects LLM inference into ES|QL execution. The feature lets detection engineers add contextual reasoning to behavioral rules without leaving the query pipeline.
How It Works
The COMPLETION operator takes a prompt string field and returns the LLM’s response in a new field. Syntax: | COMPLETION result_field = prompt_field WITH { "inference_id": ".gp-llm-v2-completion" }. The inference model can be the built‑in Elastic Cloud model or an external provider via connectors to Azure OpenAI, Amazon Bedrock, OpenAI, or Google Vertex.
Practical Use
- Aggregate related events by host, user, or session.
- Build a context string from the aggregated fields.
- Pass the context to COMPLETION to generate a reasoned assessment.
- Filter or route alerts based on the LLM output.
Getting Started
Enable an Elastic Cloud subscription that includes LLM inference. If you prefer a custom model, configure the LLM connector per the official documentation. Then add the COMPLETION clause to your detection rule and test against known benign and malicious patterns.
Considerations
- LLM responses are probabilistic; validate outputs before automating actions.
- Monitor inference costs if using external providers.
- Ensure prompt construction avoids leaking sensitive data.
Related articles
Automating Edge Defense: Mitigating Web Fuzzing and Probing via Elastic Security and Cloudflare
Exposed web infrastructure regularly encounters automated scanners looking for sensitive endpoints and vulnerable applications. By analyzing Traefik proxy logs in Elastic Security using ES|QL detection rules, defenders can spot statistical anomalies in HTTP 404 responses and automatically block malicious IP addresses at the Cloudflare edge.
Read briefing
Elastic Security Labs Releases LLM Safety Assessment Report
Elastic Security Labs has published a new LLM safety assessment report that outlines practical threats to large language models and offers guidance for defenders. The report focuses on data mapping, normalization, and detection strategy for AI‑driven threats. SecOps teams should review the findings and start implementing the recommended detection steps.
Read briefing
Elastic Security Labs Leverages LLMs to Boost Detection Engineering
Elastic Security Labs has begun integrating large language models into its detection engineering workflows, using Azure OpenAI and LangChain to streamline alert triage and analyst productivity. The initiative, tested during a dedicated ONWeek, focuses on prompt engineering and iterative validation to avoid regressions. Defenders can adopt similar AI-driven approaches to accelerate detection development and improve tier‑1 triage.
Read briefing
External Threat Intelligence Trends: LLM-Generated Malware and SOC Automation Analysis
Industry analysis for Q3 2026 highlights the rise of LLM-generated threats like PhantomRaven and the shift toward automated Agentic SOC models. Defenders are advised to integrate external intelligence directly into triage workflows to counter accelerating exploitation windows.
Read briefing