Skip to content

Adds note about minimum Defend version for Device Control #3582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 21, 2025
Merged

Adds note about minimum Defend version for Device Control #3582

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
db7200f
Adds note about minimum Defend version for Device Control
benironside Oct 21, 2025
8b70f4c
Update configure-an-integration-policy-for-elastic-defend.md
benironside Oct 21, 2025
c2d6ef3
Update solutions/security/configure-elastic-defend/configure-an-integ…
benironside Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .../configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ If you have the appropriate license or project feature tier, you can customize t

Memory threat protection detects and stops in-memory threats, such as shellcode injection, which are used to evade traditional file-based detection techniques.

:::{admonition} Requirements
::::{admonition} Requirements
:class: note
* In {{stack}}, memory threat protection is enabled by default if you have a [Platinum or Enterprise license](https://www.elastic.co/pricing). If you upgrade to a Platinum or Enterprise license from Basic or Gold, memory threat protection will be disabled by default.
* In {{serverless-short}}, memory threat protection requires the Endpoint Protection Essentials [project feature tier](/deploy-manage/deploy/elastic-cloud/project-settings.md).
Expand Down Expand Up @@ -238,6 +238,7 @@ stack: ga 9.2
serverless: ga
```


Device control helps protect your organization from data loss, malware, and unauthorized access by managing which devices can connect to your computers. Specifically, it restricts which external USB storage devices can connect to hosts that have {{elastic-defend}} installed.

To configure device control for one or more hosts, edit the {{elastic-defend}} policy that affects those hosts. Your policy specifies which operations these devices are allowed to take on a host. You can create [trusted devices](/solutions/security/manage-elastic-defend/trusted-devices.md) to define exceptions to your policy for specific devices.
Expand All @@ -250,6 +251,10 @@ To configure device control for one or more hosts, edit the {{elastic-defend}} p

By default, each {{kib}} instance includes a Device Control dashboard. When at least one of your {{elastic-defend}} policies has device control enabled, the dashboard displays data about attempted device connections and their outcomes. To access it and review information about blocked connections, search for `device control` in the **Dashboards** page's **Custom Dashboards** section.

:::{important}
To collect device control data, {{elastic-defend}} must be updated to at least version 9.2.0. Until you update it to this version, the device control dashboard will not appear and device control events will not be ingested. Device control blocking will still work.
:::

## Event collection [event-collection]

In the **Settings** section, select which categories of events to collect on each operating system. Most categories are collected by default.
Expand Down