[8.19/9.1][Security Solution] [Elastic Defend] Add windows.advanced.events.security.provider_etw in endpoint advanced policy setting (#222197)

## Summary

This PR makes the following fields available as advanced policy options
in Elastic Defend.
* `windows.advanced.events.security.provider_etw`

## Release Note
{elastic-defend} Adds advanced policy options that let users enable or
disable the Microsoft-Windows-Security-Auditing ETW provider for
security events collection.

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Asuka Nakajima 2025-06-24 19:25:54 +09:00 committed by GitHub
parent 4ebc54bbb9
commit 506079e771
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -2268,6 +2268,17 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'windows.advanced.events.security.provider_etw',
first_supported_version: '8.19.0',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.security.provider_etw',
{
defaultMessage:
'Controls whether Microsoft-Windows-Security-Auditing ETW provider is enabled for security events collection. Set to false to disable the provider. Default: true.',
}
),
},
{
key: 'linux.advanced.alerts.hash.md5',
first_supported_version: '8.16',