Mitigation policies

[Trinity2019]

Change Summary

Add mitigation_policies to Windows process creation events.

Sample values

                "mitigation_policies": [
                    "Microsoft only",
                    "CET dynamic APIs can only be called out of proc",
                    "CF Guard"
                ],

Sample document:

Here's a sample process event document.

Release Target

8.7.0

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-11-29T23:11:36.444+0000

• Duration: 9 min 37 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[Trinity2019]

/test

[Trinity2019]

@elastic/security-onboarding-and-lifecycle-mgt could anyone review this pr if anyone got any spare cycles?

[Trinity2019]

@elastic/security-onboarding-and-lifecycle-mgt can I get some review of this pr or is it code freezing time? Thanks in advance!

[kevinlog]

@Trinity2019 - apologies for the late review. This looks good to me. We were working out some issues with the 8.6.0 package and merged a couple bug fixes last week.

This change looks good to me and is purely additive, so it won't cause any mapping collisions.

[Trinity2019]

Thanks all the reviewers! No worries about delay, all good :)

[elasticmachine]

Package endpoint - 8.7.0 containing this change is available at https://epr.elastic.co/search?package=endpoint