Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.5] Adds Allowlist Elastic Endpoint in third-party antivirus apps page to serverless docs (backport #5639) #5650

Merged
merged 2 commits into from
Aug 2, 2024
Merged

[8.5] Adds Allowlist Elastic Endpoint in third-party antivirus apps page to serverless docs (backport #5639) #5650

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
975e564
Adds Allowlist Elastic Endpoint in third-party antivirus apps page to…
natasha-moore-elastic Aug 2, 2024
a333695
Delete docs/serverless directory and its contents
github-actions[bot] Aug 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/management/admin/allowlist-endpoint-3rd-party-av.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
[[allowlist-endpoint-3rd-party-av-apps]]
= Allowlist Elastic Endpoint in third-party antivirus apps

NOTE: If you use other antivirus (AV) software along with {elastic-defend}, you may need to add the other system as a trusted application in the {security-app}. Refer to <<trusted-apps-ov>> for more information.

Third-party antivirus (AV) applications may identify the expected behavior of {elastic-endpoint} as a potential threat. Add {elastic-endpoint}'s digital signatures and file paths to your AV software's allowlist to ensure {elastic-endpoint} continues to function as intended. We recommend you allowlist both the file paths and digital signatures, if applicable.

NOTE: Your AV software may refer to allowlisted processes as process exclusions, ignored processes, or trusted processes. It is important to note that file, folder, and path-based exclusions/exceptions are distinct from trusted applications and will not achieve the same result. This page explains how to ignore actions taken by processes, not how to ignore the files that spawned those processes.
Expand Down
2 changes: 2 additions & 0 deletions docs/management/admin/trusted-apps.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
[chapter, role="xpack"]
= Trusted applications

NOTE: If you use {elastic-defend} along with other antivirus (AV) software, you might need to configure the other system to trust {elastic-endpoint}. Refer to <<allowlist-endpoint-3rd-party-av-apps>> for more information.

You can add Windows, macOS, and Linux applications that should be trusted, such as other antivirus or endpoint security applications. Trusted applications are designed to help mitigate performance issues and incompatibilities with other endpoint software installed on your hosts. Trusted applications apply only to hosts running the {elastic-defend} integration.

.Requirements
Expand Down