github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[EDR Workflows] Update description on data reduction advanced options (#213970)

Browse source 
## Summary

- refines description for
- 9 `(win|mac|linux).advanced.events.hash.(md5|sha1|sha256)`:
9e7bbcf767
> Compute and include (MD5|SHA-1|SHA-256) hashes for processes and
libraries in events? This will increase CPU usage and event sizes. If
any user event filter or trustlists reference this hash type, Endpoint
will ignore this setting and automatically enable this hash type.
- 6 `(win|mac|linux).advanced.alerts.hash.(md5|sha1)`:
8fc0f51ab4
> Compute and include (MD5|SHA-1) hashes for processes and libraries in
alerts? This will increase CPU usage and alert sizes. If any user
exceptionlist, trustlist, or blocklists reference this hash type,
Endpoint will ignore this setting and automatically enable this hash
type.
- provides a 'history' for default behavior changes (e.g. `<=8.17
default: true, >=8.18 default: false`) for
- 12 `(win|mac|linux).advanced.(events|alerts).hash.(md5|sha1)`:
05b0ebe8ea
  (note that events sha256 is not changed)
    >  <=8.17 default: true, >=8.18 default: false
- 3 `(win|mac|linux).advanced.events.aggregate_process`:
5984d8e90a
    > <=8.17 default: false, >=8.18 default: true
- 3 `(win|mac|linux).advanced.events.set_extended_host_information`:
5da25a3592
    >  <=8.17 default: true, >=8.18 default: false

> [!IMPORTANT]
> The plan is to backport this PR to all open branches:
> - `8.18`/`8.x`/`9.0`/`main` will contain all modifications,
> - but `8.16`/`8.17` manual backports will only contain the description
refinement

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
This commit is contained in:
Gergő Ábrahám 2025-03-12 16:42:27 +01:00 • committed by GitHub
parent 256817b281
commit ad3b7fce11
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 21 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

42
x-pack/solutions/security/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts
View file

@ -2121,7 +2121,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2132,7 +2132,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2143,7 +2143,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.aggregate_process',
{
defaultMessage:
'Reduce event volume by merging related process events into fewer aggregate events. Default is true.',
'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
}
),
},
@ -2187,7 +2187,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2198,7 +2198,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2209,7 +2209,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2220,7 +2220,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2231,7 +2231,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2242,7 +2242,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2253,7 +2253,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2264,7 +2264,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2275,7 +2275,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2286,7 +2286,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2297,7 +2297,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.alerts.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include MD5 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2308,7 +2308,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.alerts.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in alerts? This will increase CPU usage and alert sizes. If any user exceptionlist, trustlist, or blocklists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2319,7 +2319,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.md5',
{
defaultMessage:
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include MD5 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2330,7 +2330,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.sha1',
{
defaultMessage:
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: false',
'Compute and include SHA-1 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2341,7 +2341,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.events.hash.sha256',
{
defaultMessage:
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. Default: true',
'Compute and include SHA-256 hashes for processes and libraries in events? This will increase CPU usage and event sizes. If any user event filter or trustlists reference this hash type, Endpoint will ignore this setting and automatically enable this hash type. Default: true',
}
),
},
@ -2352,7 +2352,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2363,7 +2363,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.mac.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},
@ -2374,7 +2374,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.set_extended_host_information',
{
defaultMessage:
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. Default: false',
'Include more details about hosts in events? Set to false to receive only id, name and os. Setting to true will increase event size. <=8.17 default: true, >=8.18 default: false',
}
),
},