[8.14] Add advanced setting to disable memory scan on behavior alerts (#180636)

## Summary

On behavior alerts with Defend, the default behavior is to enrich the
alert by scanning some memory regions against Yara memory signatures.

This PR adds an advanced setting to opt-out of this behavior.


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Daniel Ferullo <56368752+ferullo@users.noreply.github.com>
This commit is contained in:
Christophe Alladoum 2024-04-12 15:20:56 -07:00 committed by GitHub
parent d3c7e180fd
commit a3db876ab7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1655,6 +1655,17 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'windows.advanced.events.memory_scan',
first_supported_version: '8.14',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.memory_scan',
{
defaultMessage:
'On behavior alerts, this feature enables an additional scan of identified memory regions against well-known malware signatures. Default: true',
}
),
},
{
key: 'windows.advanced.flags',
first_supported_version: '8.13.0',