Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG][EDR Workflows] Defend windows.advanced.events.registry.enforce_registry_filters advanced option name is wrong #212526

Open
2 tasks
ferullo opened this issue Feb 26, 2025 · 1 comment
Assignees
Labels
bug Fixes for quality problems that affect the customer experience OLM Sprint Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.18.1

Comments

@ferullo
Copy link
Contributor

ferullo commented Feb 26, 2025

Kibana version:
8.15.0+

Describe the bug:
The Defend advanced option windows.advanced.events.registry.enforce_registry_filters is named wrong. The actual option in Endpoint is windows.advanced.events.enforce_registry_filters.

To fix this let's just delete the existing advanced option and add the new correct one, backporting to all supported versions and making sure to add a release note.

We considered changing Endpoint to align with the Kibana option or adding a Kibana migration when the advanced option is renamed. However, both of those approaches would actually change Endpoint's behavior on upgrade for any users that have set the wrongly named option, which would be counter to our typical upgrade approach.

AC

  •  Remove legacy policy advanced option (windows.advanced.events.registry.enforce_registry_filters ) and add the new one: windows.advanced.events.enforce_registry_filters

  •  Check if existing legacy field would be removed after policy update including the new field. If not, evaluate if we want to implement a policy migration to remove the legacy one.

@ferullo ferullo added the bug Fixes for quality problems that affect the customer experience label Feb 26, 2025
@botelastic botelastic bot added the needs-team Issues missing a team label label Feb 26, 2025
@ferullo ferullo added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution and removed needs-team Issues missing a team label labels Feb 26, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience OLM Sprint Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.18.1
Projects
None yet
Development

No branches or pull requests

4 participants