mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 09:48:58 -04:00
[Elastic Defend] Add windows.ransomware.dump_process
for endpoint advanced policy setting (#212439)
## Summary This PR exposes `windows.ransomware.dump_process` as an advanced policy option for Elastic Defend. If enabled, this option will make the endpoint generate a memory dump of the ransomware process before killing it, assisting the ransomware investigation process. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
parent
ec127e271c
commit
e9813b8c72
1 changed files with 11 additions and 0 deletions
|
@ -908,6 +908,17 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
|
|||
}
|
||||
),
|
||||
},
|
||||
{
|
||||
key: 'windows.advanced.ransomware.dump_process',
|
||||
first_supported_version: '8.11',
|
||||
documentation: i18n.translate(
|
||||
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.ransomware.dump_process',
|
||||
{
|
||||
defaultMessage:
|
||||
"A value of 'false' disables the generation of a memory dump of the Ransomware process. This is ignored if the canary protection is off. Default: true.",
|
||||
}
|
||||
),
|
||||
},
|
||||
{
|
||||
key: 'windows.advanced.memory_protection.shellcode',
|
||||
first_supported_version: '7.15',
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue