github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

[9.0] [EDR Workflows] Update description on data reduction advanced options (#213970) (#214208)

Browse source 
# Backport

This will backport the following commits from `main` to `9.0`:
- [[EDR Workflows] Update description on data reduction advanced options
(#213970)](https://github.com/elastic/kibana/pull/213970)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Gergő
Ábrahám","email":"gergo.abraham@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T15:42:27Z","message":"[EDR
Workflows] Update description on data reduction advanced options
(#213970)\n\n## Summary\n\n- refines description for\n- 9
`(win|mac|linux).advanced.events.hash.(md5|sha1|sha256)`:\n9e7bbcf767a47795ef1e791ba4f88045526ac90d\n>
Compute and include (MD5|SHA-1|SHA-256) hashes for processes
and\nlibraries in events? This will increase CPU usage and event sizes.
If\nany user event filter or trustlists reference this hash type,
Endpoint\nwill ignore this setting and automatically enable this hash
type.\n- 6
`(win|mac|linux).advanced.alerts.hash.(md5|sha1)`:\n8fc0f51ab45ffc2430683f0b05773a91e0a63717\n>
Compute and include (MD5|SHA-1) hashes for processes and libraries
in\nalerts? This will increase CPU usage and alert sizes. If any
user\nexceptionlist, trustlist, or blocklists reference this hash
type,\nEndpoint will ignore this setting and automatically enable this
hash\ntype.\n- provides a 'history' for default behavior changes (e.g.
`<=8.17\ndefault: true, >=8.18 default: false`) for\n- 12
`(win|mac|linux).advanced.(events|alerts).hash.(md5|sha1)`:\n05b0ebe8eab1a5f010f8a995454ffb05dfd502d8\n
(note that events sha256 is not changed)\n > <=8.17 default: true,
>=8.18 default: false\n- 3
`(win|mac|linux).advanced.events.aggregate_process`:\n5984d8e90a43127c93c367286d727c489612c90e\n
> <=8.17 default: false, >=8.18 default: true\n- 3
`(win|mac|linux).advanced.events.set_extended_host_information`:\n5da25a3592409b5bfbc7b7256312f2b3f67fe1b5\n
> <=8.17 default: true, >=8.18 default: false\n\n> [!IMPORTANT]\n> The
plan is to backport this PR to all open branches:\n> -
`8.18`/`8.x`/`9.0`/`main` will contain all modifications,\n> - but
`8.16`/`8.17` manual backports will only contain the
description\nrefinement\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)","sha":"ad3b7fce112d8dc0e28c847937458bf2d455fba2","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Defend
Workflows","backport:prev-minor","backport:prev-major","v9.1.0"],"title":"[EDR
Workflows] Update description on data reduction advanced
options","number":213970,"url":"https://github.com/elastic/kibana/pull/213970","mergeCommit":{"message":"[EDR
Workflows] Update description on data reduction advanced options
(#213970)\n\n## Summary\n\n- refines description for\n- 9
`(win|mac|linux).advanced.events.hash.(md5|sha1|sha256)`:\n9e7bbcf767a47795ef1e791ba4f88045526ac90d\n>
Compute and include (MD5|SHA-1|SHA-256) hashes for processes
and\nlibraries in events? This will increase CPU usage and event sizes.
If\nany user event filter or trustlists reference this hash type,
Endpoint\nwill ignore this setting and automatically enable this hash
type.\n- 6
`(win|mac|linux).advanced.alerts.hash.(md5|sha1)`:\n8fc0f51ab45ffc2430683f0b05773a91e0a63717\n>
Compute and include (MD5|SHA-1) hashes for processes and libraries
in\nalerts? This will increase CPU usage and alert sizes. If any
user\nexceptionlist, trustlist, or blocklists reference this hash
type,\nEndpoint will ignore this setting and automatically enable this
hash\ntype.\n- provides a 'history' for default behavior changes (e.g.
`<=8.17\ndefault: true, >=8.18 default: false`) for\n- 12
`(win|mac|linux).advanced.(events|alerts).hash.(md5|sha1)`:\n05b0ebe8eab1a5f010f8a995454ffb05dfd502d8\n
(note that events sha256 is not changed)\n > <=8.17 default: true,
>=8.18 default: false\n- 3
`(win|mac|linux).advanced.events.aggregate_process`:\n5984d8e90a43127c93c367286d727c489612c90e\n
> <=8.17 default: false, >=8.18 default: true\n- 3
`(win|mac|linux).advanced.events.set_extended_host_information`:\n5da25a3592409b5bfbc7b7256312f2b3f67fe1b5\n
> <=8.17 default: true, >=8.18 default: false\n\n> [!IMPORTANT]\n> The
plan is to backport this PR to all open branches:\n> -
`8.18`/`8.x`/`9.0`/`main` will contain all modifications,\n> - but
`8.16`/`8.17` manual backports will only contain the
description\nrefinement\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)","sha":"ad3b7fce112d8dc0e28c847937458bf2d455fba2"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213970","number":213970,"mergeCommit":{"message":"[EDR
Workflows] Update description on data reduction advanced options
(#213970)\n\n## Summary\n\n- refines description for\n- 9
`(win|mac|linux).advanced.events.hash.(md5|sha1|sha256)`:\n9e7bbcf767a47795ef1e791ba4f88045526ac90d\n>
Compute and include (MD5|SHA-1|SHA-256) hashes for processes
and\nlibraries in events? This will increase CPU usage and event sizes.
If\nany user event filter or trustlists reference this hash type,
Endpoint\nwill ignore this setting and automatically enable this hash
type.\n- 6
`(win|mac|linux).advanced.alerts.hash.(md5|sha1)`:\n8fc0f51ab45ffc2430683f0b05773a91e0a63717\n>
Compute and include (MD5|SHA-1) hashes for processes and libraries
in\nalerts? This will increase CPU usage and alert sizes. If any
user\nexceptionlist, trustlist, or blocklists reference this hash
type,\nEndpoint will ignore this setting and automatically enable this
hash\ntype.\n- provides a 'history' for default behavior changes (e.g.
`<=8.17\ndefault: true, >=8.18 default: false`) for\n- 12
`(win|mac|linux).advanced.(events|alerts).hash.(md5|sha1)`:\n05b0ebe8eab1a5f010f8a995454ffb05dfd502d8\n
(note that events sha256 is not changed)\n > <=8.17 default: true,
>=8.18 default: false\n- 3
`(win|mac|linux).advanced.events.aggregate_process`:\n5984d8e90a43127c93c367286d727c489612c90e\n
> <=8.17 default: false, >=8.18 default: true\n- 3
`(win|mac|linux).advanced.events.set_extended_host_information`:\n5da25a3592409b5bfbc7b7256312f2b3f67fe1b5\n
> <=8.17 default: true, >=8.18 default: false\n\n> [!IMPORTANT]\n> The
plan is to backport this PR to all open branches:\n> -
`8.18`/`8.x`/`9.0`/`main` will contain all modifications,\n> - but
`8.16`/`8.17` manual backports will only contain the
description\nrefinement\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)","sha":"ad3b7fce112d8dc0e28c847937458bf2d455fba2"}}]}]
BACKPORT-->

Co-authored-by: Gergő Ábrahám <gergo.abraham@elastic.co>
This commit is contained in:
Kibana Machine 2025-03-13 04:41:49 +11:00 • committed by GitHub
parent ef8617f63e
commit a2bf3e8d28
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 21 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

42
x-pack/solutions/security/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts
View file

@ -2110,7 +2110,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2121,7 +2121,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2132,7 +2132,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2176,7 +2176,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2187,7 +2187,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2198,7 +2198,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2209,7 +2209,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2220,7 +2220,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2231,7 +2231,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2242,7 +2242,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2253,7 +2253,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2264,7 +2264,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2275,7 +2275,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2286,7 +2286,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2297,7 +2297,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2308,7 +2308,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2319,7 +2319,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2330,7 +2330,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2341,7 +2341,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2352,7 +2352,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2363,7 +2363,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},