diff --git a/release-notes/elastic-security/breaking-changes.md b/release-notes/elastic-security/breaking-changes.md index b9759d35f6..80b6b2cc92 100644 --- a/release-notes/elastic-security/breaking-changes.md +++ b/release-notes/elastic-security/breaking-changes.md @@ -15,6 +15,18 @@ Breaking changes can impact your Elastic applications, potentially disrupting no % **Action**
Steps for mitigating deprecation impact. % :::: +## 9.0.7 [elastic-security-900-breaking-changes] +::::{dropdown} Changes invalid category for Gatekeeper + +Changes `event.category` from `security` to `configuration` for Gatekeeper on macOS. + +**Impact**
Gatekeeper events on macOS are now labeled as `event.category == configuration`. + +**Action**
If you're deploying custom rules using `event.category == security` on macOS, change the query to `event.category == configuration`. + +:::: + + ## 9.0.0 [elastic-security-900-breaking-changes] ::::{dropdown} Removes legacy security rules bulk endpoints diff --git a/release-notes/elastic-security/index.md b/release-notes/elastic-security/index.md index fde96a5d30..0231833019 100644 --- a/release-notes/elastic-security/index.md +++ b/release-notes/elastic-security/index.md @@ -157,6 +157,15 @@ To check for security updates, go to [Security announcements for the Elastic sta * Fixes a bug in {{elastic-defend}} where Linux network events would have source and destination byte counts swapped. * Fixes an issue where {{elastic-defend}} may incorrectly set the artifact channel in policy responses, and adds `manifest_type` to policy responses. +## 9.0.7 [elastic-security-9.0.7-release-notes] + +### Fixes [elastic-security-9.0.7-fixes] +* Prevents users without appropriate privileges from deleting notes [#233948]({{kib-pull}}233948). +* Fixes a bug that prevented the **MITRE ATT&CK** section from appearing in the alert details flyout [#233805]({{kib-pull}}233805). +* Updates {{kib}} MITRE ATT&CK data to v17.1 [#231375]({{kib-pull}}231375). +* Fixes a bug where Linux capabilities were included in {{elastic-endpoint}} network events despite being disabled. +* Makes the delivery of {{elastic-endpoint}} command line commands more robust. In rare cases, commands could previously fail due to interprocess communication issues. + ## 9.0.6 [elastic-security-9.0.6-release-notes] ### Features and enhancements [elastic-security-9.0.6-features-enhancements]