Documentation for filtering process descendants in Event Filters [Request]

[gergoabraham]

Description

In the context of Security / Management / Event Filters, we're introducing a new option to not simply filter Events, but filter events from all descendants of a given process - while the events from the process itself are still ingested.

Expand below to see the new Events | Process Descendants button group on the screenshots.

Background & resources

• PRs:
  • [Defend Workflows] Process descendants filtering for Event Filters - Switch on UI kibana#184947
• Issues/metas:
  • https://github.com/elastic/endpoint-dev/issues/14226
  • https://github.com/elastic/security-team/issues/9339
• Point of contact: @ferullo @dasansol92 @gabriellandau @gergoabraham
• Test environments: Kibana side is still under development

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

August - synced around 8.15 release

Feature differences

They're the same.

API docs impact

there should be no impact here

Prerequisites, privileges, feature flags

Feature flag on Kibana:
xpack.securitySolution.enableExperimental.filterProcessDescendantsForEventFiltersEnabled

---

Pull requests

Preview Give feedback

1. ESS – Process descendant filtering in event filters [ESS] #5626
2. Serverless – Process descendant filtering in event filters [serverless] #5672

[joepeeples]

Important

Release timeline means we can merge ESS docs to main now, but for serverless docs we need to wait until shortly after 8.15.0 release to merge.

🤔 Maybe try a conditional feature flag? Or just separate PRs.