You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: release-notes/elastic-cloud-serverless/known-issues.md
+18-12Lines changed: 18 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,6 +16,22 @@ Known issues are significant defects or limitations that may impact your impleme
16
16
17
17
## Active
18
18
19
+
20
+
21
+
::::{dropdown} Alerts aren't generated for rules with alert flapping off and an alert delay higher than 1
22
+
23
+
**Details**
24
+
25
+
On October 22, 2025, it was discovered that alerts aren't generated for rules that have **Alert flapping detection** turned off and the alert delay set to a value higher than 1.
26
+
27
+
**Workaround**
28
+
29
+
Set the alert delay value to 1 or turn on **Alert flapping detection**.
30
+
31
+
::::
32
+
33
+
## Resolved
34
+
19
35
:::{dropdown} Entity store transform is unavailable
20
36
21
37
**Details**
@@ -29,22 +45,12 @@ Restart the entity store:
29
45
2. On the **Entity Store** page, turn the toggle off.
30
46
3. Turn the toggle back on.
31
47
32
-
::::
33
-
34
-
::::{dropdown} Alerts aren't generated for rules with alert flapping off and an alert delay higher than 1
35
-
36
-
**Details**
37
-
38
-
On October 22, 2025, it was discovered that alerts aren't generated for rules that have **Alert flapping detection** turned off and the alert delay set to a value higher than 1.
48
+
**Resolved**
39
49
40
-
**Workaround**
41
-
42
-
Set the alert delay value to 1 or turn on **Alert flapping detection**.
50
+
This was resolved on November 4, 2025.
43
51
44
52
::::
45
53
46
-
## Resolved
47
-
48
54
:::{dropdown} CSPM and Asset Management integrations don't ingest data when deployed using agent-based technology if {{kib}} is hosted on AWS
49
55
Applies to: {{serverless-short}} deployments hosted on AWS
Copy file name to clipboardExpand all lines: release-notes/elastic-security/index.md
+40Lines changed: 40 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,6 +27,23 @@ To check for security updates, go to [Security announcements for the Elastic sta
27
27
28
28
% *
29
29
30
+
## 9.2.1 [elastic-security-9.2.1-release-notes]
31
+
32
+
### Features and enhancements [elastic-security-9.2.1-features-enhancements]
33
+
34
+
* Improves the startup log in {{elastic-defend}} to explain the details of unsigned policy.
35
+
* Improves the accuracy of thread CPU usage reported in {{elastic-defend}} metrics documents.
36
+
37
+
### Fixes [elastic-security-9.2.1-fixes]
38
+
* Fixes an issue where the CSPM and Asset Discovery integrations failed to collect data when using agent-based deployment [#241390]({{kib-pull}}241390).
39
+
* Fixes a react-query key collision that occurred when two different integration lookups shared the same key, which could cause errors when navigating between pages [#240517]({{kib-pull}}240517).
40
+
* Fixes multiple issues searching installed rules by allowing partial matches on rule name and improving special character support [#237496]({{kib-pull}}237496).
41
+
* Fixes an {{elastic-defend}} bug in Linux event collection where some long-running processes were not enriched.
42
+
* Fixes multiple {{elastic-defend}} issues in malware protection for Linux where a deadlock could sometimes occur when containers and autofs were both active.
43
+
* Fixes an {{elastic-defend}} issue that could cause the `get-file` and `execute` response actions to fail after many were issued with a single running instance of {{elastic-defend}}
44
+
* Improves {{elastic-defend}} detection of file rename operations on Windows when performed over Server Message Block (SMB).
45
+
* Fixes an {{elastic-defend}} issue on Windows where the `code_signature.thumbprint_sha256` field was missing under process and DLL events for certain event types.
46
+
30
47
31
48
## 9.2.0 [elastic-security-9.2.0-release-notes]
32
49
@@ -121,6 +138,29 @@ To check for security updates, go to [Security announcements for the Elastic sta
121
138
* Fixes an issue to improve reliability of health status reporting between {{elastic-endpoint}} and {{agent}}.
122
139
* Fixes a race condition in {{elastic-defend}} that occasionally resulted in corrupted process command lines on Windows. This could cause incorrect values for `process.command_line`, `process.args_count`, and `process.args`, leading to false positives.
123
140
* Fixes an issue in {{elastic-defend}} that could result in a crash if a specified {{ls}} output configuration contained a certificate that couldn't be parsed.
141
+
* Fixes CVE-2025-37735 ([ESA-2025-23](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272)) in {{elastic-defend}} on Windows which could allow a low-privilege attacker to delete arbitrary files on the system and potentially escalate privileges to SYSTEM. Windows 11 24H2 includes changes which make this issue harder to exploit.
142
+
143
+
144
+
## 9.1.7 [elastic-security-9.1.7-release-notes]
145
+
146
+
### Features and enhancements [elastic-security-9.1.7-features-enhancements]
147
+
* Improves the reliability of Cloud Security Posture (CSP) data by automatically upgrading outdated Misconfiguration and Vulnerabilities data views to the correct versions [#238547]({{kib-pull}}238547).
148
+
* Adds more {{elastic-defend}} options to the {{ls}} output, allowing for finer control.
149
+
* Improves the accuracy of thread CPU usage reported in {{elastic-defend}} metrics documents.
150
+
151
+
152
+
### Fixes [elastic-security-9.1.7-fixes]
153
+
* Fixes entity flyout **Risk contributions** tab link [#241153]({{kib-pull}}241153).
154
+
* Fixes a pagination issue with the data table on the **Indicators** page [#241108]({{kib-pull}}241108).
155
+
* Fixes a react-query key collision that occurred when two different integration lookups shared the same key, which could cause errors when navigating between pages [#240517]({{kib-pull}}240517).
156
+
* Fixes multiple issues searching installed rules by allowing partial matches on rule name and improving special character support [#237496]({{kib-pull}}237496).
157
+
* Fixes an issue where rule exception operators could not be cleared when editing a rule exception [#236051]({{kib-pull}}236051).
158
+
* Fixes an {{elastic-defend}} issue on Linux by preventing unnecessary locking within malware protection to avoid invalid watchdog firings.
159
+
* Fixes issues that could sometimes cause crashes of the {{elastic-defend}} user-mode process on very busy Windows systems.
160
+
* Fixes multiple {{elastic-defend}} issues in malware protection for Linux where a deadlock could sometimes occur when containers and autofs were both active.
161
+
* Fixes CVE-2025-37735 ([ESA-2025-23](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272)) in {{elastic-defend}} on Windows which could allow a low-privilege attacker to delete arbitrary files on the system and potentially escalate privileges to SYSTEM. Windows 11 24H2 includes changes which make this issue harder to exploit.
162
+
* Fixes an {{elastic-defend}} bug in Linux event collection where some long-running processes were not enriched.
163
+
* Fixes an {{elastic-defend}} issue that could cause the `get-file` and `execute` response actions to fail after many were issued with a single running instance of {{elastic-defend}}.
0 commit comments