Max alerts per run: Specify the maximum number of alerts a rule can create each time it runs.
Required fields: Create an informational list of fields that a rule requires to function.
Related integrations: Create an informational list of one or more Elastic integrations associated with a rule.

Suppress alerts for machine learning and ES|QL rules

edit

Alert suppression now supports the machine learning and ES|QL rule types. You can use it to reduce the number of repeated or duplicate detection alerts generated from machine learning and ES|QL rules.

Use AI Assistant when writing rule queries

edit

When creating rules, you can now use AI Assistant to improve rule queries or to quickly correct them.

Bulk update custom highlighted fields for rules

edit

Bulk add or remove custom highlighted fields for multiple detection rules.

Preview entities and alerts in the alert details flyout

edit

You can now preview host and user details from the Insights tab of the alert details flyout instead of going to the Hosts or Users pages for more information. From the Correlations tab in the flyout, you can also preview alerts that are related to each other instead of leaving the flyout to access them.

Expandable alert details flyout enabled by default

edit

The expandable alert details flyout is now enabled by default in multiple places throughout the Elastic Security app.

Improvements to the Timeline data exploration experience

edit

Several improvements have been made to enhance your data exploration experience in Timeline:

Multiple components from Discover have been incorporated, such as the sidebar and table, which allow you to quickly find fields of interest.
You can now toggle row renderers, which allow you to easily add or remove context from events.
Notes are easier to add and track from the new Notes flyout.

Response actions enhancements

edit

Scan files and folders for malware

edit

Elastic Defend’s new scan response action lets you perform on-demand malware scans of a specific file or directory on a host. Scans are based on the malware protection settings configured in your Elastic Defend integration policy.

Isolate and release CrowdStrike-enrolled hosts

edit

Using Elastic’s CrowdStrike integration and connector, you can now perform response actions on hosts enrolled in CrowdStrike’s endpoint protection system. These actions are available in this release:

Isolate a host from the network
Release an isolated host

Retrieve files from SentinelOne-enrolled hosts

edit

Using Elastic’s SentinelOne integration and connector, you can now retrieve files from SentinelOne-enrolled hosts and download them through Elastic Security.

Filter out process descendants

edit

Create an event filter that excludes the descendant events of a specific process, but still includes the primary process itself. This can help you limit the amount of events ingested into Elastic Security.

Cases enhancements

edit

Introducing case templates

edit

[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Kibana cases offer a new powerful capability to enhance your analyst teams' efficiency with templates. You can manage multiple templates, each of which can be used to auto-populate values in a case with pre-defined knowledge. This streamlines the investigative process and significantly reduces resolution time.

Case custom fields generally available

edit

In 8.11, custom fields were added to cases, and they are now moving from technical preview to general availability. You can set custom field values in your templates to enhance consistency across cases.

« Elastic Security overview Upgrade Elastic Security to 8.15.1 »