You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -154,7 +154,7 @@ If you have the appropriate license or project feature tier, you can customize t
154
154
155
155
Memory threat protection detects and stops in-memory threats, such as shellcode injection, which are used to evade traditional file-based detection techniques.
156
156
157
-
:::{admonition} Requirements
157
+
::::{admonition} Requirements
158
158
:class: note
159
159
* In {{stack}}, memory threat protection is enabled by default if you have a [Platinum or Enterprise license](https://www.elastic.co/pricing). If you upgrade to a Platinum or Enterprise license from Basic or Gold, memory threat protection will be disabled by default.
160
160
* In {{serverless-short}}, memory threat protection requires the Endpoint Protection Essentials [project feature tier](/deploy-manage/deploy/elastic-cloud/project-settings.md).
@@ -238,6 +238,7 @@ stack: ga 9.2
238
238
serverless: ga
239
239
```
240
240
241
+
241
242
Device control helps protect your organization from data loss, malware, and unauthorized access by managing which devices can connect to your computers. Specifically, it restricts which external USB storage devices can connect to hosts that have {{elastic-defend}} installed.
242
243
243
244
To configure device control for one or more hosts, edit the {{elastic-defend}} policy that affects those hosts. Your policy specifies which operations these devices are allowed to take on a host. You can create [trusted devices](/solutions/security/manage-elastic-defend/trusted-devices.md) to define exceptions to your policy for specific devices.
@@ -250,6 +251,10 @@ To configure device control for one or more hosts, edit the {{elastic-defend}} p
250
251
251
252
By default, each {{kib}} instance includes a Device Control dashboard. When at least one of your {{elastic-defend}} policies has device control enabled, the dashboard displays data about attempted device connections and their outcomes. To access it and review information about blocked connections, search for `device control` in the **Dashboards** page's **Custom Dashboards** section.
252
253
254
+
:::{important}
255
+
To collect device control data, {{elastic-defend}} must be updated to at least version 9.2.0. Until you update it to this version, the device control dashboard will not appear and device control events will not be ingested. Device control blocking will still work.
256
+
:::
257
+
253
258
## Event collection [event-collection]
254
259
255
260
In the **Settings** section, select which categories of events to collect on each operating system. Most categories are collected by default.
0 commit comments