Skip to content
Threat Feed

Product

Elastic Cloud

1 brief RSS
critical advisory

LLM-Based Compromised User Triage

This rule correlates multiple security alerts involving the same user, analyzes them with an LLM, and flags potentially compromised accounts based on MITRE tactics, geographic anomalies, and multi-host activity, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.

Elastic Cloud Domain: Identity Domain: LLM Use Case: Threat Detection Use Case: Identity and Access Audit Resources: Investigation Guide Rule Type: Higher-Order Rule
2r 2t