From 6f7b76ecfb15189768e4d3c5fb174b071ba5c500 Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Wed, 2 Oct 2024 16:19:29 -0400 Subject: [PATCH 1/8] First draft --- .../configure-integration-policy.asciidoc | 4 +- .../endpoint-data-volume.asciidoc | 56 +++++++++++++++++-- 2 files changed, 52 insertions(+), 8 deletions(-) diff --git a/docs/getting-started/configure-integration-policy.asciidoc b/docs/getting-started/configure-integration-policy.asciidoc index 255dd9b29e..e5eb615b67 100644 --- a/docs/getting-started/configure-integration-policy.asciidoc +++ b/docs/getting-started/configure-integration-policy.asciidoc @@ -223,8 +223,7 @@ image::images/register-as-antivirus.png[Detail of Register as antivirus option.] [[adv-policy-settings]] == Advanced policy settings (optional) -Users with unique configuration and security requirements can select **Show advanced settings** -to configure the policy to support advanced use cases. Hover over each setting to view its description. +Users with unique configuration and security requirements can select **Show advanced settings** while configuring an {elastic-defend} integration policy to support advanced use cases. Hover over each setting to view its description. NOTE: Advanced settings are not recommended for most users. @@ -233,6 +232,7 @@ This section includes: * <> * <> * <> +* <> [discrete] [[save-policy]] diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index a3cd85f6ee..a1d9d4ca89 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -1,12 +1,56 @@ [[endpoint-data-volume]] -= Configure {elastic-endpoint}'s data volume += Configure data volume for {elastic-endpoint} ++++ Configure data volume ++++ +{elastic-endpoint}, the installed component that performs {elastic-defend}'s threat monitoring and prevention, has been optimized to reduce data volume and CPU usage. You can disable or modify some of these optimizations by reconfiguring the following <> in the {elastic-defend} integration policy. -[sidebar] --- -[.text-center] -**This is a placeholder for future documentation.** --- +IMPORTANT: Modifying these advanced settings from their defaults will increase the volume of data that {elastic-endpoint} processes and ingests, and increase {elastic-endpoint}'s CPU usage. Make sure you're aware of how these changes will affect your storage capabilities and performance. + +Each setting has several OS-specific variants, represented by `[linux|mac|windows]` in the names listed below. Use the variant relevant to your hosts' operating system (for example, `windows.advanced.events.deduplicate_network_events` to configure network event deduplication for Windows hosts). + +[discrete] +[[network-event-deduplication]] +== Network event deduplication + +added:[8.15] When repeated network connections are detected from the same process, {elastic-endpoint} will not produce network events for subsequent connections. To disable or reduce deduplication of network events, use these advanced settings: + +`[linux|mac|windows].advanced.events.deduplicate_network_events`:: Enter `false` to completely disable network event deduplication. Default: `true` + +`[linux|mac|windows].advanced.events.deduplicate_network_events_below_bytes`:: Enter a transfer size threshold (in bytes) for events you want to deduplicate. Connections below the threshold are deduplicated, and connections above it are not deduplicated. This allows you to suppress repeated connections for smaller data transfers but always generate events for larger transfers. Default: `1048576` (1MB) + +[discrete] +[[host-fields]] +== Data in `host.*` fields + +added:[8.16] {elastic-endpoint} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {elastic-endpoint} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting: + +// TO DO: Still need to get setting name and values. Also the note callout needs more information. + +`[linux|mac|windows].advanced.setting.NAME`:: Enter `VALUE` to include all `host.*` event data. Default: `OTHER-VALUE` + +NOTE: Users should take note of how a lack of some `host.*` information may affect their <>. + +[discrete] +[[merged-process-network]] +== Merged process and network events + +added:[8.16] {elastic-endpoint} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means for short-lived processes only a single event is generated, containing the process details from when the process terminated. {elastic-endpoint} also merges network connection/termination events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: + + +`[linux|mac|windows].advanced.events.aggregate_process`:: Enter `false` to disable merging of process events. Default: `true` + +`[linux|mac|windows].advanced.events.aggregate_network`:: Enter `false` to disable merging of network events. Default: `true` + +NOTE: Merged events can affect the results of <>. For merged events, `event.action` is an array containing all actions merged into the single event, such as `event.action=[fork, exec, end]`. If your event filter omits all fork events (`event.action : fork`), it will also filter out all merged events that include a `fork` action. You'll need to modify the event filter to target only original `fork` events. + +[discrete] +[[md5-sha1-hashes]] +== MD5 and SHA-1 hashes + +added:[8.16] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: + +`[linux|mac|windows].advanced.alerts.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in events. Default: `false` + +`[linux|mac|windows].advanced.alerts.hash.sha1`:: Enter `true` to compute and include SHA-1 hashes for processes and libraries in events. Default: `false` From f3baed10d0a1f33b97a0617723881f1276cc6da5 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Tue, 17 Dec 2024 11:33:24 +0000 Subject: [PATCH 2/8] Apply suggestions from code review Co-authored-by: Daniel Ferullo <56368752+ferullo@users.noreply.github.com> --- docs/getting-started/endpoint-data-volume.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index a1d9d4ca89..096b1f513f 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -51,6 +51,6 @@ NOTE: Merged events can affect the results of <>. F added:[8.16] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: -`[linux|mac|windows].advanced.alerts.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in events. Default: `false` +`[linux|mac|windows].advanced.alerts.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in alerts. Default: `false` -`[linux|mac|windows].advanced.alerts.hash.sha1`:: Enter `true` to compute and include SHA-1 hashes for processes and libraries in events. Default: `false` +`[linux|mac|windows].advanced.alerts.hash.sha1`:: Enter `true` to compute and include SHA-1 hashes for processes and libraries in alerts. Default: `false` From e362a5f99c23169518ca5f62cdf41c1a85a7decf Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Tue, 17 Dec 2024 13:09:00 +0000 Subject: [PATCH 3/8] Adds additional adv settings and changes 8.16 to 8.18 --- docs/getting-started/endpoint-data-volume.asciidoc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index 096b1f513f..7bca1b2a3d 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -24,7 +24,7 @@ added:[8.15] When repeated network connections are detected from the same proces [[host-fields]] == Data in `host.*` fields -added:[8.16] {elastic-endpoint} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {elastic-endpoint} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting: +added:[8.18] {elastic-endpoint} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {elastic-endpoint} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting: // TO DO: Still need to get setting name and values. Also the note callout needs more information. @@ -36,7 +36,7 @@ NOTE: Users should take note of how a lack of some `host.*` information may affe [[merged-process-network]] == Merged process and network events -added:[8.16] {elastic-endpoint} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means for short-lived processes only a single event is generated, containing the process details from when the process terminated. {elastic-endpoint} also merges network connection/termination events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: +added:[8.18] {elastic-endpoint} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means for short-lived processes only a single event is generated, containing the process details from when the process terminated. {elastic-endpoint} also merges network connection/termination events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: `[linux|mac|windows].advanced.events.aggregate_process`:: Enter `false` to disable merging of process events. Default: `true` @@ -49,7 +49,11 @@ NOTE: Merged events can affect the results of <>. F [[md5-sha1-hashes]] == MD5 and SHA-1 hashes -added:[8.16] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: +added:[8.18] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: + +`[linux|mac|windows].advanced.events.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in events. Default: `false` + +`[linux|mac|windows].advanced.events.hash.sha1`:: Enter `true` to compute and include SHA-1 hashes for processes and libraries in events. Default: `false` `[linux|mac|windows].advanced.alerts.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in alerts. Default: `false` From f3b2998f7d04b2fb060ee177af2d772207ba52d9 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Tue, 17 Dec 2024 13:21:53 +0000 Subject: [PATCH 4/8] Adds missing adv setting info --- docs/getting-started/endpoint-data-volume.asciidoc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index 7bca1b2a3d..e27e601bfc 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -26,9 +26,7 @@ added:[8.15] When repeated network connections are detected from the same proces added:[8.18] {elastic-endpoint} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {elastic-endpoint} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting: -// TO DO: Still need to get setting name and values. Also the note callout needs more information. - -`[linux|mac|windows].advanced.setting.NAME`:: Enter `VALUE` to include all `host.*` event data. Default: `OTHER-VALUE` +`[linux|mac|windows].advanced.set_extended_host_information`:: Enter `true` to include all `host.*` event data. Default: `false` NOTE: Users should take note of how a lack of some `host.*` information may affect their <>. From c39d2b649f6a1444f9ed969fa314cf564f150ec9 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Wed, 18 Dec 2024 18:52:52 +0000 Subject: [PATCH 5/8] Address feedback --- docs/getting-started/endpoint-data-volume.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index e27e601bfc..f97bbb53dc 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -28,7 +28,7 @@ added:[8.18] {elastic-endpoint} includes only a small subset of the data in the `[linux|mac|windows].advanced.set_extended_host_information`:: Enter `true` to include all `host.*` event data. Default: `false` -NOTE: Users should take note of how a lack of some `host.*` information may affect their <>. +NOTE: Users should take note of how a lack of some `host.*` information may affect their <> or alert exceptions. [discrete] [[merged-process-network]] @@ -41,7 +41,7 @@ added:[8.18] {elastic-endpoint} merges process `create`/`terminate` events (Wind `[linux|mac|windows].advanced.events.aggregate_network`:: Enter `false` to disable merging of network events. Default: `true` -NOTE: Merged events can affect the results of <>. For merged events, `event.action` is an array containing all actions merged into the single event, such as `event.action=[fork, exec, end]`. If your event filter omits all fork events (`event.action : fork`), it will also filter out all merged events that include a `fork` action. You'll need to modify the event filter to target only original `fork` events. +NOTE: Merged events can affect the results of <>. For merged events, `event.action` is an array containing all actions merged into the single event, such as `event.action=[fork, exec, end]`. If your event filter omits all fork events (`event.action : fork`), it will also filter out all merged events that include a `fork` action. In this case, you'll need to restore the prior {elastic-endpoint} behavior using the advanced setting to delete the filter. [discrete] [[md5-sha1-hashes]] From d10d48f8a2565b433def54bd4d7a4f1227e96b4b Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Mon, 6 Jan 2025 11:25:27 +0000 Subject: [PATCH 6/8] Apply suggestions from code review Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> --- docs/getting-started/endpoint-data-volume.asciidoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index f97bbb53dc..57d798ba42 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -4,7 +4,7 @@ Configure data volume ++++ -{elastic-endpoint}, the installed component that performs {elastic-defend}'s threat monitoring and prevention, has been optimized to reduce data volume and CPU usage. You can disable or modify some of these optimizations by reconfiguring the following <> in the {elastic-defend} integration policy. +{elastic-endpoint}, the installed component that performs {elastic-defend}'s threat monitoring and prevention, is optimized to reduce data volume and CPU usage. You can disable or modify some of these optimizations by reconfiguring the following <> in the {elastic-defend} integration policy. IMPORTANT: Modifying these advanced settings from their defaults will increase the volume of data that {elastic-endpoint} processes and ingests, and increase {elastic-endpoint}'s CPU usage. Make sure you're aware of how these changes will affect your storage capabilities and performance. @@ -28,13 +28,13 @@ added:[8.18] {elastic-endpoint} includes only a small subset of the data in the `[linux|mac|windows].advanced.set_extended_host_information`:: Enter `true` to include all `host.*` event data. Default: `false` -NOTE: Users should take note of how a lack of some `host.*` information may affect their <> or alert exceptions. +NOTE: Users should take note of how a lack of some `host.*` information may affect their <> or <>. [discrete] [[merged-process-network]] == Merged process and network events -added:[8.18] {elastic-endpoint} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means for short-lived processes only a single event is generated, containing the process details from when the process terminated. {elastic-endpoint} also merges network connection/termination events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: +added:[8.18] {elastic-endpoint} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means short-lived processes only generate a single event containing the details from when the process terminated. {elastic-endpoint} also merges network `connection/termination` events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: `[linux|mac|windows].advanced.events.aggregate_process`:: Enter `false` to disable merging of process events. Default: `true` From de3461c8efa446f1e19d62ada1bdc77de3959eea Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Mon, 6 Jan 2025 13:57:01 +0000 Subject: [PATCH 7/8] Update docs/getting-started/endpoint-data-volume.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> --- docs/getting-started/endpoint-data-volume.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index 57d798ba42..e7d05508b2 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -47,7 +47,7 @@ NOTE: Merged events can affect the results of <>. F [[md5-sha1-hashes]] == MD5 and SHA-1 hashes -added:[8.18] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: +added:[8.18] {elastic-endpoint} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any <>, <>, <>, or <> require them. To include these hashes in all event data, use these advanced settings: `[linux|mac|windows].advanced.events.hash.md5`:: Enter `true` to compute and include MD5 hashes for processes and libraries in events. Default: `false` From 4566753c6db3eb874b1cf91fbba44324597ba25b Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Thu, 9 Jan 2025 15:08:29 +0000 Subject: [PATCH 8/8] Update docs/getting-started/endpoint-data-volume.asciidoc Co-authored-by: Daniel Ferullo <56368752+ferullo@users.noreply.github.com> --- docs/getting-started/endpoint-data-volume.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/endpoint-data-volume.asciidoc b/docs/getting-started/endpoint-data-volume.asciidoc index e7d05508b2..e392b66547 100644 --- a/docs/getting-started/endpoint-data-volume.asciidoc +++ b/docs/getting-started/endpoint-data-volume.asciidoc @@ -41,7 +41,7 @@ added:[8.18] {elastic-endpoint} merges process `create`/`terminate` events (Wind `[linux|mac|windows].advanced.events.aggregate_network`:: Enter `false` to disable merging of network events. Default: `true` -NOTE: Merged events can affect the results of <>. For merged events, `event.action` is an array containing all actions merged into the single event, such as `event.action=[fork, exec, end]`. If your event filter omits all fork events (`event.action : fork`), it will also filter out all merged events that include a `fork` action. In this case, you'll need to restore the prior {elastic-endpoint} behavior using the advanced setting to delete the filter. +NOTE: Merged events can affect the results of <>. Notably, for merged events, `event.action` is an array containing all actions merged into the single event, such as `event.action=[fork, exec, end]`. In that example, if your event filter omits all fork events (`event.action : fork`), it will also filter out all merged events that include a `fork` action. To prevent such issues, you'll need to modify your event filters accordingly, or set the `[linux|mac|windows].advanced.events.aggregate_process` and `[linux|mac|windows].advanced.events.aggregate_network` advanced settings to `false` to prevent {elastic-endpoint} from merging events. [discrete] [[md5-sha1-hashes]]