-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
11957 hardware breakpoint set #333
Conversation
…tic/endpoint-package into asuka_11957-hardware_breakpoint_set
custom_schemas/custom_process.yml
Outdated
description: > | ||
Check whether a hardware breakpoint is set for the thread. | ||
Include this field, only if the hardware breakpoint is setted. | ||
example: "true" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This generates a non-fatal warning - "Short descriptions must be single line, and under 120 characters"
You can explicitly set a short description with short:
description: > | |
Check whether a hardware breakpoint is set for the thread. | |
Include this field, only if the hardware breakpoint is setted. | |
example: "true" | |
short: Whether a hardware breakpoint was set for the thread. | |
description: > | |
Whether a hardware breakpoint was set for the thread. | |
This field is omitted if false. | |
example: "true" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks! Fixed as suggested!
/test |
c2f2616
to
7e136fe
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Green build |
Thank you very much of fixing this issue, Gabe! |
Hi @pzl @gergoabraham ! Could you take a look when you get a chance? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
Sorry for the wait, but thanks for the bump, this is good to merge
@pzl Thanks for reviewing! |
Package endpoint - 8.7.0 containing this change is available at https://epr.elastic.co/search?package=endpoint |
Change Summary
This PR adds a new field which indicates whether a hardware breakpoint is set for a thread.
Protections team is interested in this information because, for example, hardware breakpoints are used for patch-less hooking to bypass security products/features such as AMSI.
Sample values
see
package/endpoint/data_stream/alerts/sample_event.json
Release Target
8.8.0
Q/A
For mapping changes:
make
after making the schema changes, and committed all changesmetadata
change, I also updated both transform destination schemas to matchFor Transform changes: