Improves the experience of bulk editing index patterns on rules by warning users early that machine learning rules can’t be edited ( #134664).Įnhances rule previews with configurable rule intervals and look-back times ( #137102).Įnhances the status pending badge for endpoint actions with a detailed status when you hover on it ( #136966). Updates the Network page’s UI to match the Hosts and Users pages ( #137541, #136913). Also adds the related integrations badge to the Rules table ( #131475). You must enable the session view data setting on your Endpoint and Cloud Security integration policy to enrich these events with session data and Kubernetes metadata fields.Īdds support for Amazon Elastic Kubernetes Service (EKS) to Kubernetes Security Posture Management (KSPM).Īdds new fields to prebuilt detection rules' schemas: related_integrations, required_fields, and setup ( #132409).Īdds the Related integrations, Required fields, and Setup guide sections to the rule details page to help users identify and meet a rule’s prerequisites. Provides support for process, file, and network events in Kubernetes. Credential hardening prevents attackers from stealing credentials stored in Windows system process memory.Īdds an endpoint self-healing feature to roll back file changes and processes on Windows endpoints when a prevention alert is generated by enabled protection features.Īdds the ability to run query packs as live queries ( #132198). Includes integration policy errors and statuses in Fleet and Elastic Security to help troubleshoot when an Elastic Agent has an Unhealthy status ( #136241, #136038).Īdds Attack surface reduction protections feature to reduce vulnerabilities on Windows endpoints. New operators are matches and does not match ( #136147).Īdds a new search query parameter, dry_run, to the bulk actions API that allows you to simulate a bulk action without permanently updating rules ( #134664).Ĭreates the response console, an interface that enables you to take actions on specific hosts ( #135360, #134520). Shows process alerts in the event process analyzer ( #135340).Īdds support for wildcard exceptions for detection rules. Creates a new rule type, New Terms, that creates an alert when a value appears for the first time in a particular field ( #134526).Īdds the Insights section to the Alert details flyout to show related cases and alerts ( #136009, #138419)
0 kommentar(er)
