Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/AI-for-security/connect-to-azure-openai.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ The following video demonstrates these steps.
Finally, configure the connector in {kib}:

. Log in to {kib}.
. Go to **Stack Management → Connectors → Create connector → OpenAI**.
. Find the **Connectors** page in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Then click **Create Connector**, and select **OpenAI**.
. Give your connector a name to help you keep track of different models, such as `Azure OpenAI (GPT-4 Turbo v. 0125)`.
. For **Select an OpenAI provider**, choose **Azure OpenAI**.
. Update the **URL** field. We recommend doing the following:
Expand Down
2 changes: 1 addition & 1 deletion docs/AI-for-security/connect-to-bedrock.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ The following video demonstrates these steps.
Finally, configure the connector in {kib}:

. Log in to {kib}.
. Go to **Stack Management → Connectors → Create connector → Amazon Bedrock**.
. . Find the **Connectors** page in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Then click **Create Connector**, and select **Amazon Bedrock**.
. Name your connector.
. (Optional) Configure the Amazon Bedrock connector to use a different AWS region where Anthropic models are supported by editing the **URL** field, for example by changing `us-east-1` to `eu-central-1`.
. (Optional) Add one of the following strings if you want to use a model other than the default:
Expand Down
2 changes: 1 addition & 1 deletion docs/AI-for-security/connect-to-byo.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ image::images/lms-custom-logs-config.png[The configuration window for the custom
Finally, configure the connector:

1. Log in to your Elastic deployment.
2. Navigate to **Stack Management → Connectors → Create ConnectorOpenAI**. The OpenAI connector enables this use case because LM Studio uses the OpenAI SDK.
2. Find the **Connectors** page in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Then click **Create Connector**, and select **OpenAI**. The OpenAI connector enables this use case because LM Studio uses the OpenAI SDK.
3. Name your connector to help keep track of the model version you are using.
4. Under **Select an OpenAI provider**, select **Other (OpenAI Compatible Service)**.
5. Under **URL**, enter the domain name specified in your Nginx configuration file, followed by `/v1/chat/completions`.
Expand Down
2 changes: 1 addition & 1 deletion docs/AI-for-security/connect-to-openai.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ The following video demonstrates these steps.
To integrate with {kib}:

. Log in to {kib}.
. Navigate to **Stack Management → Connectors → Create ConnectorOpenAI**.
. Find the **Connectors** page in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Then click **Create Connector**, and select **OpenAI**.
. Provide a name for your connector, such as `OpenAI (GPT-4 Turbo Preview)`, to help keep track of the model and version you are using.
. Under **Select an OpenAI provider**, choose **OpenAI**.
. The **URL** field can be left as default.
Expand Down
2 changes: 1 addition & 1 deletion docs/AI-for-security/connect-to-vertex.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ The following video demonstrates these steps.
Finally, configure the connector in your Elastic deployment:

1. Log in to your Elastic deployment.
2. Navigate to **Stack Management → Connectors → Create ConnectorGoogle Gemini**.
2. Find the **Connectors** page in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Then click **Create Connector**, select **Google Gemini**.
3. Name your connector to help keep track of the model version you are using.
4. Under **URL**, enter the URL for your region.
5. Enter your **GCP Region** and **GCP Project ID**.
Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-native-security/cspm-benchmark-rules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ NOTE: Benchmark rules are not editable.
[discrete]
== Review your benchmarks

To access your active benchmarks, go to **Rules -> Benchmarks**. From there, you can click a benchmark's name to view the benchmark rules associated with it. You can click a benchmark rule's name to see details including information about how to remediate it, and related links.
Find **Benchmarks** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. From there, you can click a benchmark's name to view the benchmark rules associated with it. You can click a benchmark rule's name to see details including information about how to remediate it, and related links.

Benchmark rules are enabled by default, but you can disable some of them — at the benchmark level — to suit your environment. This means for example that if you have two integrations using the `CIS AWS` benchmark, disabling a rule for that benchmark affects both integrations. To enable or disable a rule, use the **Enabled** toggle on the right of the rules table.

Expand Down
4 changes: 2 additions & 2 deletions docs/cloud-native-security/cspm-get-started-aws.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ You can set up CSPM for AWS either by enrolling a single cloud account, or by en
== Agentless deployment
beta::[]

. From the Elastic Security *Get started* page, click *Add integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Select *AWS*, then either *AWS Organization* to onboard multiple accounts, or *Single Account* to onboard an individual account.
Expand All @@ -53,7 +53,7 @@ beta::[]
[discrete]
[[cspm-add-and-name-integration]]
=== Add the CSPM integration
. From the Elastic Security *Get started* page, click *Add integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Select *AWS*, then either *AWS Organization* to onboard multiple accounts, or *Single Account* to onboard an individual account.
Expand Down
5 changes: 3 additions & 2 deletions docs/cloud-native-security/cspm-get-started-azure.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ You can set up CSPM for Azure by by enrolling an Azure organization (management
== Agentless deployment
beta::[]

. From the Elastic Security *Get started* page, click *Add integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Select *Azure*, then either *Azure Organization* to onboard your whole organization, or *Single Subscription* to onboard an individual subscription.
Expand All @@ -51,7 +51,8 @@ beta::[]
[discrete]
[[cspm-add-and-name-integration-azure]]
=== Add your CSPM integration
. From the Elastic Security *Get started* page, click *Add integrations*.

. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Under **Configure integration**, select **Azure**, then select either **Azure Organization** or **Single Subscription**, depending on which resources you want to monitor.
Expand Down
4 changes: 2 additions & 2 deletions docs/cloud-native-security/cspm-get-started-gcp.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ You can set up CSPM for GCP either by enrolling a single project, or by enrollin
== Agentless deployment
beta::[]

. From the Elastic Security *Get started* page, click *Add integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Select *GCP*, then either *GCP Organization* to onboard your whole organization, or *Single Account* to onboard an individual account.
Expand All @@ -52,7 +52,7 @@ beta::[]
[discrete]
[[cspm-add-and-name-integration-gcp]]
=== Add your CSPM integration
. From the Elastic Security *Get started* page, click *Add integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for `CSPM`, then click on the result.
. Click *Add Cloud Security Posture Management (CSPM)*.
. Under *Configure integration*, select *GCP*, then either *GCP Organization* (recommended) or *Single Account*.
Expand Down
7 changes: 3 additions & 4 deletions docs/cloud-native-security/d4c-get-started.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ This page describes how to set up Cloud Workload Protection (CWP) for Kubernetes

First, you'll need to deploy Elastic's Defend for Containers integration to the Kubernetes clusters you wish to monitor.

. Go to *Manage > Container Workload Security > Add D4C Integration*.
. Find **Container Workload Security** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Click **Add D4C Integration**.
. Name the integration. The default name, which you can change, is `cloud_defend-1`.
. Optional — make any desired changes to the integration's policy by adjusting the *Selectors* and *Responses* sections. (For more information, refer to the <<d4c-policy-guide, Defend for Containers policy guide>>). You can also change these later.
. Under *Where to add this integration*, select an existing or new agent policy.
Expand Down Expand Up @@ -54,7 +54,7 @@ In order to detect threats using this data, you'll need active <<detection-engin

To install and enable the prebuilt rules:

. Go to *Security > Rules > Detection rules (SIEM)*, then click *Add Elastic rules*.
. Find **Detection rules (SIEM)** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Click **Add Elastic rules**.
. Click the *Tags* filter next to the search bar, and search for the `Data Source: Elastic Defend for Containers` tag.
. Select all the displayed rules, then click *Install _x_ selected rule(s)*.
. Return to the *Rules* page. Click the *Tags* filter next to the search bar, and search for the `Data Source: Elastic Defend for Containers` tag.
Expand All @@ -75,8 +75,7 @@ To enable drift detection, you can use the default D4C policy:

To enable drift prevention, create a new policy:

. Add a new selector called `blockDrift`.
. Go to *Security > Manage > Container Workload Security > Your integration name*.
. Find **Container Workload Security** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], then select your integration.
. Under *Selectors*, click *Add selector > File Selector*. By default, it selects the operations `createExecutable` and `modifyExecutable`.
. Name the selector, for example: `blockDrift`.
. Scroll down to the *Responses* section and click *Add response > File Response*.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,11 @@ You can configure an {agent} policy to capture up to five environment variables

To set up environment variable capture for an {agent} policy:

. Go to **Security -> Manage -> Policies**.

. Find **Policies** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Select an {agent} policy.
. Click *Show advanced settings*.
. Scroll down or search for `linux.advanced.capture_env_vars`.
. Scroll down or search for `linux.advanced.capture_env_vars` or `mac.advanced.capture_env_vars`.
. Enter the names of env vars you want to capture, separated by commas. For example: `PATH,USER`
. Click *Save*.

Expand All @@ -37,7 +38,7 @@ Captured environment variables are associated with process events, and appear in

To view environment variables in the *Events* table:

. Click the *Events* tab on the *Hosts*, *Network*, or *Users* pages (*Security -> Explore*), then click *Fields* in the Events table.
. Click the *Events* tab on the *Hosts*, *Network*, or *Users* pages, then click *Fields* in the Events table.
. Search for the `process.env_vars` field, select it, and click *Close*.
A new column appears containing captured environment variable data.

Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-native-security/kspm-benchmark-rules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ NOTE: Benchmark rules are not editable.
[discrete]
== Review your benchmarks

To access your active benchmarks, go to **Rules -> Benchmarks**. From there, you can click a benchmark's name to view the benchmark rules associated with it. You can click a benchmark rule's name to see details including information about how to remediate it, and related links.
Find **Benchmarks** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. From there, you can click a benchmark's name to view the benchmark rules associated with it. You can click a benchmark rule's name to see details including information about how to remediate it, and related links.

Benchmark rules are enabled by default, but you can disable some of them — at the benchmark level — to suit your environment. This means for example that if you have two integrations using the `CIS AWS` benchmark, disabling a rule for that benchmark affects both integrations. To enable or disable a rule, use the **Enabled** toggle on the right of the rules table.

Expand Down
4 changes: 2 additions & 2 deletions docs/cloud-native-security/kspm-get-started.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ The instructions differ depending on whether you're installing on EKS or on unma
[discrete]
=== Name your integration and select a Kubernetes Deployment type

1. Go to *Dashboards -> Cloud Security Posture*.
1. Find **Cloud Security Posture** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
2. Click *Add a KSPM integration*.
3. Read the integration's description to understand how it works. Then, click {integrations-docs}/cloud_security_posture[*Add Kubernetes Security Posture Management*].
4. Name your integration. Use a name that matches the purpose or team of the cluster(s) you want to monitor, for example, `IT-dev-k8s-clusters`.
Expand Down Expand Up @@ -234,7 +234,7 @@ Follow these steps to deploy the KSPM integration to unmanaged clusters. Keep in
=== Configure the KSPM integration
To install the integration on unmanaged clusters:

. Go to *Dashboards -> Cloud Security Posture*.
. Find **Cloud Security Posture** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Click *Add a KSPM integration*.
. Read the integration's description to understand how it works. Then, click {integrations-docs}/cloud_security_posture[*Add Kubernetes Security Posture Management*].
. Name your integration. Use a name that matches the purpose or team of the cluster(s) you want to monitor, for example, `IT-dev-k8s-clusters`.
Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-native-security/kspm.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ To identify the Kubernetes resources generating the most failed findings:

To identify risks in particular CIS sections:

. Go to the <<cloud-nat-sec-posture-dashboard,Cloud Security Posture dashboard>> (*Dashboards -> Cloud Security Posture*).
. Go to the <<cloud-nat-sec-posture-dashboard,Cloud Security Posture dashboard>>.
. In the Failed findings by CIS section widget, click the name of a CIS section to view all failed findings for that section.

Alternatively:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ Using the data generated by these features, you can:

*Identify and secure misconfigured infrastructure:*

. Go to the Cloud Security Posture dashboard (*Dashboards > Cloud Security Posture*).
. Find **Cloud Security Posture** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Click *View all failed findings*, either for an individual resource or a group of resources.
. Click a failed finding to open the Findings flyout.
. Follow the steps under Remediation to fix the misconfiguration.

*Identify the CIS Sections (security best practice categories) with which your resources are least compliant:*

. Go to the Cloud Security Posture dashboard (*Dashboards > Cloud Security Posture*).
. Find **Cloud Security Posture** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Do one of the following:
.. Under Failed findings by CIS section, click the name of a CIS section to view all failed findings from that section.
.. Go to the *Findings* page and filter by the `rule.section` field. For example, search for `rule.section : API Server` to view findings from the API Server category.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ IMPORTANT: Do not add the integration to an existing {agent} policy. It should a
[[vuln-management-setup-step-1]]
=== Step 1: Add the CNVM integration

. In the {security-app}, go to the **Get started** page, then click *Add security integrations*.
. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
. Search for **Cloud Native Vulnerability Management**, then click on the result.
. Click *Add Cloud Native Vulnerability Management*.
. Give your integration a name that matches its purpose or the AWS account region you want to scan for vulnerabilities (for example, `uswest2-aws-account`.)
Expand Down