You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This functionality was added in {{elastic-agent}} 8.15.0.
29
+
:::
30
+
27
31
When repeated network connections are detected from the same process, {{elastic-endpoint}} will not produce network events for subsequent connections. To disable or reduce deduplication of network events, use these advanced settings:
@@ -35,6 +39,10 @@ When repeated network connections are detected from the same process, {{elastic-
35
39
36
40
## Data in `host.*` fields [host-fields]
37
41
42
+
:::{admonition} Added in 8.18.0
43
+
This functionality was added in {{elastic-agent}} 8.18.0.
44
+
:::
45
+
38
46
{{elastic-endpoint}} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {{elastic-endpoint}} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting:
@@ -48,6 +56,10 @@ Users should take note of how a lack of some `host.*` information may affect the
48
56
49
57
## Merged process and network events [merged-process-network]
50
58
59
+
:::{admonition} Added in 8.18.0
60
+
This functionality was added in {{elastic-agent}} 8.18.0.
61
+
:::
62
+
51
63
{{elastic-endpoint}} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means short-lived processes only generate a single event containing the details from when the process terminated. {{elastic-endpoint}} also merges network `connection/termination` events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings:
@@ -64,6 +76,10 @@ Merged events can affect the results of [event filters](../manage-elastic-defend
64
76
65
77
## MD5 and SHA-1 hashes [md5-sha1-hashes]
66
78
79
+
:::{admonition} Added in 8.18.0
80
+
This functionality was added in {{elastic-agent}} 8.18.0.
81
+
:::
82
+
67
83
{{elastic-endpoint}} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any [trusted applications](../manage-elastic-defend/trusted-applications.md), [blocklist entries](../manage-elastic-defend/blocklist.md), [event filters](../manage-elastic-defend/event-filters.md), or [Endpoint exceptions](../detect-and-alert/add-manage-exceptions.md#endpoint-rule-exceptions) require them. To include these hashes in all event data, use these advanced settings:
0 commit comments