Skip to content

Commit 4a81fee

Browse files
Add Agent version info to Endpoint data volume page
1 parent ea451a6 commit 4a81fee

File tree

1 file changed

+16
-0
lines changed

1 file changed

+16
-0
lines changed

solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ Each setting has several OS-specific variants, represented by `[linux|mac|window
2424

2525
## Network event deduplication [network-event-deduplication]
2626

27+
:::{admonition} Added in 8.15.0
28+
This functionality was added in {{elastic-agent}} 8.15.0.
29+
:::
30+
2731
When repeated network connections are detected from the same process, {{elastic-endpoint}} will not produce network events for subsequent connections. To disable or reduce deduplication of network events, use these advanced settings:
2832

2933
`[linux|mac|windows].advanced.events.deduplicate_network_events`
@@ -35,6 +39,10 @@ When repeated network connections are detected from the same process, {{elastic-
3539

3640
## Data in `host.*` fields [host-fields]
3741

42+
:::{admonition} Added in 8.18.0
43+
This functionality was added in {{elastic-agent}} 8.18.0.
44+
:::
45+
3846
{{elastic-endpoint}} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {{elastic-endpoint}} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting:
3947

4048
`[linux|mac|windows].advanced.set_extended_host_information`
@@ -48,6 +56,10 @@ Users should take note of how a lack of some `host.*` information may affect the
4856

4957
## Merged process and network events [merged-process-network]
5058

59+
:::{admonition} Added in 8.18.0
60+
This functionality was added in {{elastic-agent}} 8.18.0.
61+
:::
62+
5163
{{elastic-endpoint}} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means short-lived processes only generate a single event containing the details from when the process terminated. {{elastic-endpoint}} also merges network `connection/termination` events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings:
5264

5365
`[linux|mac|windows].advanced.events.aggregate_process`
@@ -64,6 +76,10 @@ Merged events can affect the results of [event filters](../manage-elastic-defend
6476

6577
## MD5 and SHA-1 hashes [md5-sha1-hashes]
6678

79+
:::{admonition} Added in 8.18.0
80+
This functionality was added in {{elastic-agent}} 8.18.0.
81+
:::
82+
6783
{{elastic-endpoint}} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any [trusted applications](../manage-elastic-defend/trusted-applications.md), [blocklist entries](../manage-elastic-defend/blocklist.md), [event filters](../manage-elastic-defend/event-filters.md), or [Endpoint exceptions](../detect-and-alert/add-manage-exceptions.md#endpoint-rule-exceptions) require them. To include these hashes in all event data, use these advanced settings:
6884

6985
`[linux|mac|windows].advanced.events.hash.md5`

0 commit comments

Comments
 (0)