Skip to content

Commit f502675

Browse files
Adds links for endpoint protection rules (#7036) (#7043)
(cherry picked from commit 3bc0ca7) Co-authored-by: natasha-moore-elastic <[email protected]>
1 parent f4d58c1 commit f502675

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

docs/management/admin/endpoint-protection-rules.asciidoc

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,30 +14,30 @@ When endpoint protection rules are triggered, {elastic-endpoint} alerts are disp
1414
[[endpoint-sec-rule]]
1515
== Endpoint Security rule
1616

17-
The Endpoint Security rule automatically creates an alert from all incoming {elastic-endpoint} alerts.
17+
The <<endpoint-security-elastic-defend>> rule automatically creates an alert from all incoming {elastic-endpoint} alerts.
1818

19-
NOTE: When you install Elastic prebuilt rules, the {elastic-defend} is enabled by default.
19+
NOTE: When you install Elastic prebuilt rules, the Endpoint Security ({elastic-defend}) rule is enabled by default.
2020

2121
[discrete]
2222
[[feature-protection-rules]]
2323
== Feature-specific protection rules
2424

2525
The following endpoint protection rules give you more granular control over how you handle the generated alerts. These rules are tailored for each of {elastic-defend}'s endpoint protection features—malware, ransomware, memory threats, and malicious behavior. Enabling these rules allows you to configure more specific actions based on the protection feature and whether the malicious activity was prevented or detected.
2626

27-
* Behavior - Detected - {elastic-defend}
28-
* Behavior - Prevented - {elastic-defend}
29-
* Malicious File - Detected - {elastic-defend}
30-
* Malicious File - Prevented - {elastic-defend}
31-
* Memory Signature - Detected - {elastic-defend}
32-
* Memory Signature - Prevented - {elastic-defend}
33-
* Ransomware - Detected - {elastic-defend}
34-
* Ransomware - Prevented - {elastic-defend}
27+
* <<behavior-detected-elastic-defend>>
28+
* <<behavior-prevented-elastic-defend>>
29+
* <<malicious-file-detected-elastic-defend>>
30+
* <<malicious-file-prevented-elastic-defend>>
31+
* <<memory-threat-detected-elastic-defend>>
32+
* <<memory-threat-prevented-elastic-defend>>
33+
* <<ransomware-detected-elastic-defend>>
34+
* <<ransomware-prevented-elastic-defend>>
3535

36-
NOTE: If you choose to use the feature-specific protection rules, we recommend that you disable the Endpoint Security rule, as using both will result in duplicate alerts.
36+
NOTE: If you choose to use the feature-specific protection rules, we recommend that you disable the Endpoint Security ({elastic-defend}) rule, as using both will result in duplicate alerts.
3737

3838
To use these rules, you need to manually enable them from the **Rules** page in the {security-app}. Follow the instructions for <<load-prebuilt-rules,installing and enabling Elastic prebuilt rules>>.
3939

4040
[discrete]
4141
== Endpoint security exception handling
4242

43-
All endpoint protection rules share a common exception list called the Endpoint Security Exception List. This ensures that if you switch between using the Endpoint Security rule and the feature-specific protection rules, your existing <<endpoint-rule-exceptions, {elastic-endpoint} exceptions>> continue to apply.
43+
All endpoint protection rules share a common exception list called the Endpoint Security Exception List. This ensures that if you switch between using the Endpoint Security ({elastic-defend}) rule and the feature-specific protection rules, your existing <<endpoint-rule-exceptions, {elastic-endpoint} exceptions>> continue to apply.

0 commit comments

Comments
 (0)