Tag

Use Case: Threat Detection

1 brief RSS

LLM-Based Compromised User Triage

This rule correlates multiple security alerts involving the same user, analyzes them with an LLM, and flags potentially compromised accounts based on MITRE tactics, geographic anomalies, and multi-host activity, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.

Elastic Cloud Domain: Identity Domain: LLM Use Case: Threat Detection Use Case: Identity and Access Audit Resources: Investigation Guide Rule Type: Higher-Order Rule

2r 2t 6d ago