Skip to content

Commit 9b87270

Browse files
benironsidenastasha-solomon
authored andcommitted
Adds note about minimum Defend version for Device Control (elastic#3582)
Fixes elastic/docs-content-internal/issues/420 by adding a note about the minimum Defend version that can collect device control data from endpoints. --------- Co-authored-by: Nastasha Solomon <[email protected]>
1 parent 397f222 commit 9b87270

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ If you have the appropriate license or project feature tier, you can customize t
154154

155155
Memory threat protection detects and stops in-memory threats, such as shellcode injection, which are used to evade traditional file-based detection techniques.
156156

157-
:::{admonition} Requirements
157+
::::{admonition} Requirements
158158
:class: note
159159
* In {{stack}}, memory threat protection is enabled by default if you have a [Platinum or Enterprise license](https://www.elastic.co/pricing). If you upgrade to a Platinum or Enterprise license from Basic or Gold, memory threat protection will be disabled by default.
160160
* In {{serverless-short}}, memory threat protection requires the Endpoint Protection Essentials [project feature tier](/deploy-manage/deploy/elastic-cloud/project-settings.md).
@@ -238,6 +238,7 @@ stack: ga 9.2
238238
serverless: ga
239239
```
240240
241+
241242
Device control helps protect your organization from data loss, malware, and unauthorized access by managing which devices can connect to your computers. Specifically, it restricts which external USB storage devices can connect to hosts that have {{elastic-defend}} installed.
242243
243244
To configure device control for one or more hosts, edit the {{elastic-defend}} policy that affects those hosts. Your policy specifies which operations these devices are allowed to take on a host. You can create [trusted devices](/solutions/security/manage-elastic-defend/trusted-devices.md) to define exceptions to your policy for specific devices.
@@ -250,6 +251,10 @@ To configure device control for one or more hosts, edit the {{elastic-defend}} p
250251
251252
By default, each {{kib}} instance includes a Device Control dashboard. When at least one of your {{elastic-defend}} policies has device control enabled, the dashboard displays data about attempted device connections and their outcomes. To access it and review information about blocked connections, search for `device control` in the **Dashboards** page's **Custom Dashboards** section.
252253

254+
:::{important}
255+
To collect device control data, {{elastic-defend}} must be updated to at least version 9.2.0. Until you update it to this version, the device control dashboard will not appear and device control events will not be ingested. Device control blocking will still work.
256+
:::
257+
253258
## Event collection [event-collection]
254259

255260
In the **Settings** section, select which categories of events to collect on each operating system. Most categories are collected by default.

0 commit comments

Comments
 (0)