Reverse-engineering Elastic detection rules with Opus 5.5 and GPT-6 Astra

The author spent five days using Opus 5.5 Max and GPT-6 Astra to reverse-engineer Elastic Security and published all extracted rules on GitHub.

Kostas

@KostastsaleArchived 9 days agoOriginally posted 2026.10.20

Kostas @KostastsaleOriginally posted 2026.10.20

Open original on X

I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here: https://github.com/elastic/detection-rules You’re welcome.

x.com/kostastsale/status/2112445178409890265Archived 2026.10.21 10:07

Open original on X