Skip to content

Commit

Permalink
[Elastic Defend] Add windows.ransomware.dump_process for endpoint a…
Browse files Browse the repository at this point in the history
…dvanced policy setting (#212439)

## Summary

This PR exposes `windows.ransomware.dump_process` as an advanced policy
option for Elastic Defend.
If enabled, this option will make the endpoint generate a memory dump of
the ransomware process before killing it, assisting the ransomware
investigation process.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit e9813b8)
  • Loading branch information
calladoum-elastic committed Mar 4, 2025
1 parent 4776c2c commit d1efbdb
Showing 1 changed file with 11 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -845,6 +845,17 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
}
),
},
{
key: 'windows.advanced.ransomware.dump_process',
first_supported_version: '8.11',
documentation: i18n.translate(
'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.ransomware.dump_process',
{
defaultMessage:
"A value of 'false' disables the generation of a memory dump of the Ransomware process. This is ignored if the canary protection is off. Default: true.",
}
),
},
{
key: 'windows.advanced.memory_protection.shellcode',
first_supported_version: '7.15',
Expand Down

0 comments on commit d1efbdb

Please sign in to comment.