Elastic Defend advanced settings

[natasha-moore-elastic]

Resolves elastic/security-docs#2234 by documenting the Elastic Defend policy advanced settings in the Reference section.
The setting descriptions consist of the Kibana tooltip text (in italics) and, for most settings, an additional description. The Kibana tooltip text was kept because some settings don't have an additional description.

Preview: Elastic Defend advanced settings

[ferullo]

Thanks. I'll review this as soon as I can. @joe-desimone @gabriellandau @magermark @nfritts you may want to review also and/or mention this to others.

[AsuNa-jp]

Hi @natasha-moore-elastic @ferullo
Today I've opened the following advanced policy draft PR for 8.19/9.1 feature.
Should I add the advanced policy from the draft PR to this PR as well, or would it be better to request everyone’s review first?

• [Security Solution] [Elastic Defend] Add disable_origin_info_collection in endpoint advanced policy setting

[ferullo]

I noticed the in-app help text is included along with additional information (which mirrors the format of the source Google doc). I wonder, now that this online documentation is being added, do we want to shorten the in-app text and provide a link to this page? Or merge the two types of documentation for each option here and then have the in-app text mirror that revised text? Something else? Just leave it as is?

I'm up for doing a pass at updating this or the in-app text if you'd like to do any of those things. Otherwise I'm also happy to review this as it is.

cc @roxana-gheorghe

[natasha-moore-elastic]

I noticed the in-app help text is included along with additional information (which mirrors the format of the source Google doc). I wonder, now that this online documentation is being added, do we want to shorten the in-app text and provide a link to this page? Or merge the two types of documentation for each option here and then have the in-app text mirror that revised text? Something else? Just leave it as is?

I'm up for doing a pass at updating this or the in-app text if you'd like to do any of those things. Otherwise I'm also happy to review this as it is.

cc @roxana-gheorghe

Good question! I included the tooltip text since some settings don’t have any additional description and would have otherwise been blank.

Ideally, I’d lean toward keeping the tooltip text short in the UI, and linking from the tooltips to the public docs, where users can get the full context. A lot of the tooltips are already fairly concise (1–2 sentences), so it’s likely not all of them would need changes, if we decided to go that route.

That said, since the Docs team is currently going through a major reorg, we’re pretty limited with resources, and any significant edits to this page would need to take a lower priority compared to writing new feature docs for 8.19/9.1.

[natasha-moore-elastic]

Hi @natasha-moore-elastic @ferullo Today I've opened the following advanced policy draft PR for 8.19/9.1 feature. Should I add the advanced policy from the draft PR to this PR as well, or would it be better to request everyone’s review first?

• [Security Solution] [Elastic Defend] Add disable_origin_info_collection in endpoint advanced policy setting

Hi @AsuNa-jp, I think you’re good to add the new advanced setting (along with its tooltip text and any additional description) to this PR, thanks!

[AsuNa-jp]

Hi @natasha-moore-elastic
Thank you for your reply. I’ve added the advanced policy for disable_origin_info_collection in the following commit.
If there’s any part that needs correction or revision, please feel free to let me know.
e6125a7

Additionally, I realized that we need to add the following advanced policy config in 8.19/9.1, so I’ve created a new PR on the Kibana side.

• windows.advanced.events.security.provider_etw
  • [Security Solution] [Elastic Defend] Add windows.advanced.events.security.provider_etw in endpoint advanced policy setting

I’ve added the same policy and tooltip text to this PR as well (in the commit below), but please feel free to let me know if there’s any issue. 4acd765

[nfritts]

This applies to all the cert fields, but do you think we should list the cert limitations here (versions that support EC certs being the main one that comes to mind)

[natasha-moore-elastic]

@nfritts We could add the following note under the descriptions for artifacts.global.ca_cert, artifacts.user.ca_cert, and elasticsearch.tls.ca_cert:

"Elliptic Curve (EC) certificates are supported starting with Elastic Endpoint v8.19.0 and v9.1.0. Earlier versions either silently ignore unsupported EC certificates (pre-8.16.0) or report a policy response error (8.16.0–8.18.x). Use RSA certificates or upgrade Elastic Endpoint to a supported version."

Does that sound right?

[ferullo]

That said, since the Docs team is currently going through a major reorg, we’re pretty limited with resources, and any significant edits to this page would need to take a lower priority compared to writing new feature docs for 8.19/9.1.

This taking a little longer is OK. I want to make the right long term decision. I spoke with @roxana-gheorghe and we'd like to do this

1. Add a link to this new documentation within Kibana within the "Proceed with caution" message (see below)
2. Shorten Kibana tooltips as appropriate since there will now be more thorough online documentation
3. Condense documentation in this PR so there is only a single description

If you are ok with that, I can make a pass to accomplish (2) and (3) so you can mostly just accept suggestions in this PR. I realize this likely means this PR slips past 8.19/9.1.

[natasha-moore-elastic]

That said, since the Docs team is currently going through a major reorg, we’re pretty limited with resources, and any significant edits to this page would need to take a lower priority compared to writing new feature docs for 8.19/9.1.

This taking a little longer is OK. I want to make the right long term decision. I spoke with @roxana-gheorghe and we'd like to do this

1. Add a link to this new documentation within Kibana within the "Proceed with caution" message (see below)
2. Shorten Kibana tooltips as appropriate since there will now be more thorough online documentation
3. Condense documentation in this PR so there is only a single description

If you are ok with that, I can make a pass to accomplish (2) and (3) so you can mostly just accept suggestions in this PR. I realize this likely means this PR slips past 8.19/9.1.

Totally agree that would be a much better user experience – feel free to make edits to this PR and thanks for the help!

[github-actions]

🔍 Preview links for changed docs:

• reference/security/defend-advanced-settings.md
• solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md

🔔 The preview site may take up to 3 minutes to finish building. These links will become live once it completes.

[alaudazzi]

I left a few minor suggestions on text that might be somehow generated.

[natasha-moore-elastic]

Hey @ferullo, to avoid keeping a stale PR open, I'd propose that we merge this PR in its current state and make the edits in a later iteration. Since Caitlin and Janeen agreed that the Dev team would own this doc after it's published, the team could then work on shortening the Kibana tooltips and updating this doc in tandem whenever there's bandwidth. The Doc team would still be happy to support by reviewing any updates to the tooltips/descriptions. Let me know if this works!

[ferullo]

Hey @ferullo, to avoid keeping a stale PR open, I'd propose that we merge this PR in its current state and make the edits in a later iteration. Since Caitlin and Janeen agreed that the Dev team would own this doc after it's published, the team could then work on shortening the Kibana tooltips and updating this doc in tandem whenever there's bandwidth. The Doc team would still be happy to support by reviewing any updates to the tooltips/descriptions. Let me know if this works!

That sounds good to me. I will watch for this PR to be merged then start work to make the changes we agreed to.

[ferullo]

LGTM, but can we move this page from where it is currently located to somewhere around this page?

[natasha-moore-elastic]

LGTM, but can we move this page from where it is currently located to somewhere around this page?

In our new docs IA we have a separate section for all reference-type content, but you've reminded me that in the sync with Caitlin we agreed to cross-link to this page from the https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#adv-policy-settings section so that it's easier to find. I've gone ahead and added that link now.