LLM-Based Attack Chain Triage by Host

This Elastic Security rule, released in February 2026 and updated in April 2026, is designed to correlate multiple endpoint security alerts from the same host. It utilizes an Elastic Managed LLM (gp-llm-v2), available in version 9.3.0+, to analyze command lines, parent processes, file operations, DNS queries, registry modifications, module loads, and MITRE ATT&CK tactics progression. The LLM provides a verdict (TP/FP/SUSPICIOUS) with a confidence score and a summary explanation. The goal is to help security analysts prioritize hosts exhibiting corroborated malicious behavior while filtering out benign activity, ultimately improving triage efficiency and response effectiveness. The rule requires a minimum Elastic Stack version of 9.3.0.

Attack Chain

1. Multiple endpoint security alerts are generated on a single host due to suspicious activities.
2. The rule aggregates these alerts based on the host ID and name, collecting relevant data such as process command lines, parent processes, file paths, DNS queries, and registry modifications.
3. The aggregated data is formatted into a summary string, which serves as context for the LLM.
4. The LLM analyzes the summary, considering factors like suspicious domains, encoded payloads, download-and-execute patterns, and persistence mechanisms.
5. The LLM provides a verdict (TP/FP/SUSPICIOUS), a confidence score, and a short summary explaining its reasoning.
6. The rule filters the results, focusing on findings where the LLM verdict is either "tp" (true positive) or "suspicious" and the confidence score is above 0.7.
7. The LLM summary is mapped to ECS fields like message and event.reason for timeline visibility.
8. High-confidence TP verdicts trigger immediate host isolation to contain potential compromise, followed by IOC extraction and remediation steps.

Impact

Successful exploitation can lead to delayed incident response and allow attackers to persist in the environment. The LLM-based approach aims to reduce false positives, allowing analysts to focus on genuine threats. Failing to detect and respond to correlated malicious activity can lead to data breaches, system compromise, and operational disruption. The rule helps analysts prioritize investigation of hosts with multiple, related alerts that suggest an ongoing attack campaign.

Recommendation

• Ensure your Elastic Stack is upgraded to version 9.3.0 or later to support the ES|QL COMPLETION command.
• Deploy the "LLM-Based Attack Chain Triage by Host" rule in your Elastic environment and tune the confidence threshold based on your environment's noise level.
• Review the investigation guide linked in the rule metadata to understand how to triage and analyze the LLM's verdicts.
• Configure an LLM connector to utilize the rule with a different LLM provider, as detailed in the LLM connector documentation.
• Enable endpoint security alerts with sufficient context to ensure the LLM has enough data for accurate analysis (process command lines, parent processes, file paths, DNS queries, registry modifications, module loads).