mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 01:38:56 -04:00
[Security Solution] Defend advanced policy option to disable process and thread handle events (#173674)
## Summary Defend Advanced Policy option to allow users to disable collection and reporting of process/thread handle events. This can be used to troubleshoot performance issues. The feature has actually been in Defend since 8.1.0, but it was never exposed via Kibana. Should we backport it past 8.12.0? ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) <!--ONMERGE {"backportTargets":["8.12"]} ONMERGE--> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
parent
641177e2fe
commit
ea580e69f1
1 changed files with 10 additions and 0 deletions
|
@ -681,6 +681,16 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
|
|||
}
|
||||
),
|
||||
},
|
||||
{
|
||||
key: 'windows.advanced.kernel.process_handle',
|
||||
first_supported_version: '8.1',
|
||||
documentation: i18n.translate(
|
||||
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.process_handle',
|
||||
{
|
||||
defaultMessage: 'Capture process and thread handle events. Default: true.',
|
||||
}
|
||||
),
|
||||
},
|
||||
{
|
||||
key: 'windows.advanced.diagnostic.enabled',
|
||||
first_supported_version: '7.11',
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue