Extract every Elastic Security detection rule with two coding agents
A security researcher ran Opus 5.5 on max and GPT-6 Astra for five days straight to reverse-engineer Elastic Security and pull out all of its detection rules.
Source
@Kostastsale on X · 2026-10-20
Written in our own words. Credit to the original author. Link checked 2026-10-22.
What they did
A security researcher ran Opus 5.5 on max and GPT-6 Astra for five days straight to reverse-engineer Elastic Security and pull out all of its detection rules.
Result (as claimed)
Published the full rule set for others to use.
Tools they used
Cost: Claude Opus 5.5: from $4 in / $20 out per 1M tokens; GPT-6 Astra: from $10 in / $50 out per 1M tokens.
Set it up
Gather your sources
Collect the papers, notes, links or files you want to work from in one place.
Load them into the tool
Open Claude Opus 5.5, GPT-6 Astra, Elastic Security and add your sources. Keep the original files so you can check claims later.
Ask focused questions
Ask for summaries, comparisons or connections with citations to the source passages.
Verify and save
Spot check claims against the sources, then save the output as notes you can reuse.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Extract every Elastic Security detection rule with two coding agents What the original author did: A security researcher ran Opus 5.5 on max and GPT-6 Astra for five days straight to reverse-engineer Elastic Security and pull out all of its detection rules. Reported result (as claimed by the author): Published the full rule set for others to use. Source: https://x.com/Kostastsale/status/2112445178409890265 Tools they used: Claude Opus 5.5, GPT-6 Astra, Elastic Security Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Extract every Elastic Security detection rule with two coding agents What the original author did: A security researcher ran Opus 5.5 on max and GPT-6 Astra for five days straight to reverse-engineer Elastic Security and pull out all of its detection rules. Reported result (as claimed by the author): Published the full rule set for others to use. Source: https://x.com/Kostastsale/status/2112445178409890265 Tools they used: Claude Opus 5.5, GPT-6 Astra, Elastic Security Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Extract every Elastic Security detection rule with two coding agents What the original author did: A security researcher ran Opus 5.5 on max and GPT-6 Astra for five days straight to reverse-engineer Elastic Security and pull out all of its detection rules. Reported result (as claimed by the author): Published the full rule set for others to use. Source: https://x.com/Kostastsale/status/2112445178409890265 Tools they used: Claude Opus 5.5, GPT-6 Astra, Elastic Security Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
How to reverse-engineer and revive old devices with AI · How to secure vibe-coded apps and agents · How to run multiple coding agents together
Related use cases
Compare four AI models by asking each to build the same machine
One prompt, build a radial engine, went to Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon and Grok 4.7. Each built a different machine, which shows how differently the models interpret the same words.
Find and play 800+ AI-built browser games in one place
A former Newgrounds kid kept losing track of AI-made games shared on X and Reddit, so he built Playground, a directory of independent browser games made with AI. You can filter by model (GPT-6 Astra, Opus 5.5 and others) and by device, and submit your own.
Build a Crossy Road clone with one prompt and compare two models
GPT-6 Astra and Opus 5.5, both on High, got the same prompt for a Crossy Road clone. Astra went soft and dreamy with misty trees; Opus went full arcade with chunky colors, trains and trucks.
Split a three.js browser game between two models
He vibe-coded a small three.js driving game about the Roadster 2, giving GPT-6 Astra the 3D modeling and physics simulation and Claude Opus 5.5 the game mechanics, controls, UI and visual design.