Endpoint Advanced Policy Option: advanced.events.check_debug_registers (#167308)

## Summary

New advanced Endpoint/Defend option.  See its description for details.

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)

<!--ONMERGE {"backportTargets":["8.9"]} ONMERGE-->

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Gabriel Landau 2023-09-29 09:31:12 -04:00 committed by GitHub
parent d9b026d7e1
commit 4c4b2d4497
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1351,4 +1351,15 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'windows.advanced.events.check_debug_registers',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.check_debug_registers',
{
defaultMessage:
'Check debug registers inline to detect the use of hardware breakpoints. Malware may use hardware breakpoints to forge benign-looking call stacks. Default: true',
}
),
},
];