diff --git a/release-notes/elastic-security/index.md b/release-notes/elastic-security/index.md index f0e33a99a4..d7acf91f6a 100644 --- a/release-notes/elastic-security/index.md +++ b/release-notes/elastic-security/index.md @@ -207,6 +207,35 @@ To check for security updates, go to [Security announcements for the Elastic sta * Fixes a sharing violation in the `get-file` response action in {{elastic-defend}}. +## 9.4.5 [elastic-security-9.4.5-release-notes] + +### Features and enhancements [elastic-security-9.4.5-features-enhancements] + +* Defaults the {{ls}} output port to `5044` in {{elastic-defend}} when no port is provided. + +### Fixes [elastic-security-9.4.5-fixes] + +* Fixes an issue that allowed index Knowledge Base entries to be created as globally readable without the privilege to manage global entries by sending an empty `users` list [#283195]({{kib-pull}}283195). +* Fixes an issue where the OpenAI **Other** connector incorrectly re-enabled **Enable PKI Authentication** after saving with the toggle turned off [#282843]({{kib-pull}}282843). +* Fixes an issue where the **Source event** link in an alert's **Highlighted fields** section failed to open the document when it lived in a hidden restored or partial index [#282272]({{kib-pull}}282272). +* Fixes a crash when opening a case whose comment contains a URL with an `×tamp` query parameter [#282265]({{kib-pull}}282265). +* Fixes missing audit events when bulk editing rules. Attaching or detaching shared exception lists to detection rules via the **Manage rules** screen now emits per-rule audit write events in the {{kib}} audit log [#281075]({{kib-pull}}281075). +* Fixes a privilege bypass that allowed users with detection rule privileges to attach {{elastic-defend}} or Osquery response actions through the generic Alerting API without the required Endpoint or Osquery privileges [#280430]({{kib-pull}}280430). +* Fixes the analyzer alert-hits query so it honors the `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting, which previously excluded cold and frozen tiers only from other analyzer queries [#278972]({{kib-pull}}278972). +* Adds a date range picker above the **Alerts related by ancestry** table in the correlations section and bounds the underlying query to it, preventing timeouts on very large indices [#278971]({{kib-pull}}278971). +* Fixes a crash when opening the rule panel flyout for a deleted rule caused by missing `severity_mapping` or `risk_score_mapping` fields [#278545]({{kib-pull}}278545). +* Fixes an error that prevented adding the Osquery Manager integration in custom {{kib}} spaces when a global Osquery pack existed in the Default space [#278498]({{kib-pull}}278498). +* Fixes intermittent duplicate execution of scheduled Osquery packs by deduplicating concurrent {{fleet}} package-policy writes for package policies shared across multiple agent policies [#278159]({{kib-pull}}278159). +* Fixes an issue where {{elastic-defend}} WFP firewall anti-tamper rules were not reinstated after a restart when the policy had not changed. +* Fixes a CPU spin loop in {{elastic-defend}} that could occur when a middlebox (such as Zscaler or a load balancer) dropped a TLS connection to {{ls}} or {{es}}, preventing event delivery until the agent was restarted. +* Fixes an issue where {{elastic-defend}} immediately retried sending documents when {{es}} failed to ingest them. +* Fixes a TLS handshake failure in {{elastic-defend}} on Windows when a server sends a leaf-only certificate chain and the issuing intermediate CA is installed in the Windows Intermediate CA store. +* Fixes a TLS handshake failure ("certificate chain too long") in {{elastic-defend}} on Windows with cross-signed CA certificates in the Intermediate CA store. +* Fixes {{elastic-defend}} notifications not appearing on macOS Sonoma and later. +* Fixes a resource leak in {{elastic-defend}} Lua libraries. +* Preserves source and destination details for outbound IPv6 TCP connections in {{elastic-defend}} on Linux. + + ## 9.4.4 [elastic-security-9.4.4-release-notes] ### Features and enhancements [elastic-security-9.4.4-features-enhancements]