[Request] 8 New Endpoint Security promotion rules

[caitlinbetz]

Description

We are creating 8 new, optional, Elastic Defend (Endpoint) promotion rules (https://github.com/elastic/security-team/issues/6287). These will be 4 Detection & 4 Prevention rules for Behavior Protection, Malware, Ransomware, & Memory protection (8 total).

Today, when a user installs Elastic Defend, we automatically enable the "Endpoint Security" promotion rule which ensures alerts are properly generated from Defend (https://www.elastic.co/guide/en/security/master/detection-engine-overview.html). However, using a single promotion rule for all the Elastic Endpoint security alerts implies that all alerts from the endpoint (prevention or detection alerts) are handled the same way. Users must manually inspect each alert’s metadata to determine if it was preventive or only detection. In addition, users can't configure different actions (endpoint response actions or otherwise) based on the alert type. These additional endpoint security rules provide more of this flexibility.

Enabling the single Endpoint Security rule by default upon installation of Defend will continue to be the default behavior. These 8 new rules will be optional - user can manually enable these in the Rules section of the app.

I don't believe we have any content in our Defend focused pages about rules (I believe the main mention is on the page noted above, https://www.elastic.co/guide/en/security/master/detection-engine-overview.html). It could be beneficial to add something to the install or policy pages regarding how they can use these different rules.

Background & resources

• PRs:
• Issues/metas: https://github.com/elastic/security-team/issues/6287
• Point of contact: @approksiu @caitlinbetz
• Test environments:

Which documentation set does this change impact?

ESS and serverless

ESS release

8.16

Serverless release

TBD

Feature differences

No changes between ESS/Serverless

API docs impact

TBD

Prerequisites, privileges, feature flags

No response

[caitlinbetz]

@approksiu - can you confirm:

• If user has all 8 new rules enabled, and the existing endpoint security rule, they will receive duplicate alerts
• there is no downside/user impact to enabling all 8 new rules (with original endpoint security rule disabled) - they will receive appropriate alerts based on defend policy config
• no differences between serverless and ESS? (when will these be made available for serverless?)

[approksiu]

@caitlinbetz yes, all you mention is correct.

[nicpenning]

👀