v9.3.0

What's Changed

• Add process.Ext.trusted to custom docs for already-running process events by @gabriellandau in #697
• Add Missing custom doc for thumbprint_sha256 by @soolidsnake in #698
• Fix macOS file access documentation by @ricardo-estc in #699
• map event.module for logs-endpoint.events.api-* by @ferullo in #700
• Add process group to macos documentation by @ricardo-estc in #702
• Add WinHTTP/WinINet ETW fields for production by @matthewh-elastic in #703
• Add script fields to process events. by @ricardo-estc in #704
• fix field def from #704 by @pzl in #707
• Move Thumbprint enrichment to production by @soolidsnake in #706
• [EDR Workflows] Add Automatic Troubleshooting knowledge base documents by @szwarckonrad in #705
• Add entropy and header_bytes on linux by @stanek-michal in #696
• Update the copyright year to 2026 by @AsuNa-jp in #709
• Release 9.3.0 by @pzl in #713

New Contributors

• @szwarckonrad made their first contribution in #705

Full Changelog: v9.2.0...v9.3.0