Solo developer publishes Elastic Security detection rules extracted using AI models

Kostas (@Kostastsale), a solo developer, says he spent five days using Opus 5.5 on max and GPT-6 Astra to reverse engineer Elastic Security and extract its detection rules.

He has made the extracted rules available on GitHub at github.com/elastic/detection-rules, according to a post on X.

The report comes from a single X post. It does not describe how the rules were checked for accuracy or whether Elastic has responded.