[Security Solution] Defend advanced policy option to disable process and thread handle events (#173674)

## Summary

Defend Advanced Policy option to allow users to disable collection and
reporting of process/thread handle events. This can be used to
troubleshoot performance issues.

The feature has actually been in Defend since 8.1.0, but it was never
exposed via Kibana. Should we backport it past 8.12.0?

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)


<!--ONMERGE {"backportTargets":["8.12"]} ONMERGE-->

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Gabriel Landau 2023-12-19 17:58:58 -05:00 committed by GitHub
parent 641177e2fe
commit ea580e69f1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -681,6 +681,16 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'windows.advanced.kernel.process_handle',
first_supported_version: '8.1',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.process_handle',
{
defaultMessage: 'Capture process and thread handle events. Default: true.',
}
),
},
{
key: 'windows.advanced.diagnostic.enabled',
first_supported_version: '7.11',