[DOCS] Endpoint self-healing rollback

[joepeeples]

Description

New "self-healing" endpoint policy advanced setting enables automatic rollback of 5 minutes previous to any "Prevent"-related endpoint alert. Windows only. By default, this setting is NOT enabled.

Need to sufficiently warn users that this could cause data loss and should be used very carefully.

NOTE: The advanced feature may be renamed soon; currently it's windows.advanced.alerts.rollback.self_healing.enabled.

Related

• https://github.com/elastic/endpoint-dev/issues/10118

Notes

• Windows only
• Confirm licensing requirements