Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SECURITY_SOLUTION][ENDPOINT] Fix Trusted Apps so that process.executable field is used for file paths #79216

Merged
merged 2 commits into from
Oct 2, 2020
Merged

[SECURITY_SOLUTION][ENDPOINT] Fix Trusted Apps so that process.executable field is used for file paths #79216

merged 2 commits into from
Oct 2, 2020

Conversation

paul-tavares
Copy link
Contributor

Summary

Change the Trusted Apps condition field name to be process.executable instead of process.path.

UI:

image

Artifact:

{
  "entries": [
    {
      "type": "simple",
      "entries": [
        {
          "field": "process.executable",
          "operator": "included",
          "type": "exact_caseless",
          "value": "c:\\windows"
        }
      ]
    }
  ]
}

Checklist

@paul-tavares paul-tavares added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Endpoint Management Feature:Endpoint Elastic Endpoint feature v7.10.0 labels Oct 1, 2020
@paul-tavares paul-tavares requested review from a team as code owners October 1, 2020 21:07
@paul-tavares paul-tavares self-assigned this Oct 1, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-management (Team:Endpoint Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-app-team (Feature:Endpoint)

kevinlog
kevinlog approved these changes Oct 1, 2020
View reviewed changes
Copy link
Contributor

@kevinlog kevinlog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

async chunks size

id before after diff
securitySolution 10.3MB 10.3MB +12.0B

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@paul-tavares paul-tavares merged commit 79eb9b7 into elastic:master Oct 2, 2020
@paul-tavares paul-tavares deleted the fix/olm-385-ta-change-file-path-field-name branch October 2, 2020 12:54
@paul-tavares paul-tavares mentioned this pull request Oct 2, 2020
Merged
paul-tavares added a commit to paul-tavares/kibana that referenced this pull request Oct 2, 2020
@paul-tavares
Use process.executable instead of process.path (elastic#79216)
dc18794
paul-tavares added a commit that referenced this pull request Oct 2, 2020
@paul-tavares
Use process.executable instead of process.path (#79216) (#79285)
6ee60b9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kevinlog kevinlog kevinlog approved these changes

@gabriellandau gabriellandau gabriellandau approved these changes

Assignees

@paul-tavares paul-tavares

Labels
Feature:Endpoint Elastic Endpoint feature release_note:skip Skip the PR/issue when compiling release notes v7.10.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@paul-tavares @elasticmachine @kibanamachine @gabriellandau @kevinlog