github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-06-27 10:40:07 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] Add mac and enrichment fields advanced Policy setting for 8.11 (#167536)

Browse source 
## Summary
Adds new advanced Policy options for Mac for 8.11

<img width="1728" alt="image"
src="0948817b-32b4-4573-90b1-756d41a38d42">

<img width="1728" alt="image"
src="297d7d51-7785-402a-918f-e41fc30cf211">

Enrichment fields:
<img width="1728" alt="image"
src="f8ddc1de-c118-4bd4-9c57-b88fec957b8f">

<img width="1726" alt="image"
src="04087c19-7533-41ab-938e-868a8570a3eb">

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Daniel Ferullo <56368752+ferullo@users.noreply.github.com>
This commit is contained in:
Kevin Logan 2023-09-29 17:34:46 -04:00 • committed by GitHub
parent 90faf2bd24
commit 872504aed5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 66 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

66
x-pack/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts
View file

@ -1362,4 +1362,70 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'mac.advanced.kernel.fileaccess',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.fileaccess',
{
defaultMessage:
'A value of false overrides other config settings that would enable kernel fileaccess events. Default: true.',
}
),
},
{
key: 'mac.advanced.events.image_load',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.image_load',
{
defaultMessage:
'A value of false overrides other config settings that would enable kernel image load events. Default: true.',
}
),
},
{
key: 'mac.advanced.image_load.capture',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.image_load.collect',
{
defaultMessage:
'Collect and send image load events to Elasticsearch. Take caution, this can be a very high data volume. Adding an event filter to drop unwanted events is strongly recommended. Default: false',
}
),
},
{
key: 'windows.advanced.document_enrichment.fields',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.document_enrichment.fields',
{
defaultMessage:
'A comma delimited set of key=value pairs of values to add into all Endpoint documents. Each key must begin with Custom. An example is Custom.key=value1,Custom.key2=value2',
}
),
},
{
key: 'mac.advanced.document_enrichment.fields',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.document_enrichment.fields',
{
defaultMessage:
'A comma delimited set of key=value pairs of values to add into all Endpoint documents. Each key must begin with Custom. An example is Custom.key=value1,Custom.key2=value2',
}
),
},
{
key: 'linux.advanced.document_enrichment.fields',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.document_enrichment.fields',
{
defaultMessage:
'A comma delimited set of key=value pairs of values to add into all Endpoint documents. Each key must begin with Custom. An example is Custom.key=value1,Custom.key2=value2',
}
),
},
];