Better document what the subparts of Elastic Defend mean

[111andre111]

At this time there is a lack of information of what exactly is meant by the subparts of Elastic Defend:
https://www.elastic.co/guide/en/security/master/configure-endpoint-integration-policy.html#event-collection

We should add some more information of what exactly we mean by Event collection. What does that mean from an Endpoint perspective.
I would review the following subparts as a first start:

• Ransomware Protection
• Memory threat protection
• Malicious behaviour detection
• Event Collection
  • Credential Access
  • DLL and Driver Load
  • DNS
  • File
  • Network
  • Process
  • Registry
  • Security
    Especially for the latter what means e.g. a File Event under Windows respectively Linux or MacOS?

^^ @jmikell821

[jmikell821]

@111andre111 can you elaborate what you want us to expand on? We describe in detail the protections you listed (ransomware, memory threat protection, etc.) So for event collection, are you saying you want us to describe what each event for each OS collects in detail? I'm not sure I understand your request 100%.

[111andre111]

Let me give you an example: We expose here quite in detail information of how we monitor filesystem.
https://www.elastic.co/guide/en/security/master/linux-file-monitoring.html
Similar to that I would expect would discuss a little bit more specific insights in how we collect events. I think we collect on Linux based on kprobes, on Windows on the other hand it might be ETW. Not sure how that happens on MacOS.
And then it would be interesting like I said on the originating request file, network and process are on all OSes supported it seems. The rest of the events
Credential Access, DLL and Driver Load, DNS, Registry, Security
are collected on Windows only, but still one wants to know what this means exactly.
For registry I remember for instance I have seen some SDHes that Registry events have some specialties. We should expose as well that we collect these as best effort.

If anything else comes to my mind I'll let know here.