[EDR Workflows] Align advanced option tool-tips with elastic.co documentation #230269

ferullo · 2025-08-01T15:42:14Z

Summary

This aligns the tool-tips shown in Kibana to the same Docs-Team-approved-text on https://www.elastic.co/docs/reference/security/defend-advanced-settings (including a few pending updates in elastic/docs-content#2365). One new advanced option is added. It's been missing from Kibana -- it isn't new.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

Identify risks

No risk assuming this renders right in Kibana. It's just tool-tip wording changes.

ferullo · 2025-08-01T15:43:45Z

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

+    ),
+    license: 'platinum',
+  },
+  {


This is the new option that was added.

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

…agement/pages/policy/models/advanced_policy_schema.ts

…to align-advanced-options

kibanamachine · 2025-09-15T18:21:49Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/415

…options

ashokaditya

Thanks for the changes. I've a few suggestions that apply to all the text changes. I think overall, the messages can be improved/simplified so it is easier to understand. I would suggest that we get someone from the docs team to proof read the copy changes here.

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

ashokaditya · 2025-09-29T10:41:46Z

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

@@ -152,7 +156,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
      'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.logging.file',
      {
        defaultMessage:
-          'A supplied value will override the log level configured for logs that are saved to disk and streamed to Elasticsearch. It is recommended Fleet be used to change this logging in most circumstances. Allowed values are error, warning, info, debug, and trace.',
+          "Override the log level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",


I think logging level since we have logging setting later in the sentence?

Suggested change

"Override the log level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",

"Override the logging level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",

I think "log level" is the normal phrase.

I see. I would then suggest that we use ...log setting... or just setting instead of ...logging setting.... Same suggestion for all other changes that use similar phrasing.

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

ashokaditya · 2025-09-29T11:28:34Z

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

@@ -2176,7 +2205,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
      'xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.aggregate_process',
      {
        defaultMessage:
-          'Reduce event volume by merging related process events into fewer aggregate events. <=8.17 default: false, >=8.18 default: true',
+          'Reduce event volume by merging related process events into fewer aggregate events. Default: <=8.17: false, >=8.18: true.',


Compared to previous Default values above, these default values that are specific to a stack version are confusing to read and understand. For <=8.17, Default: true. For >=8.18 Default: false. might be better and easier to understand and that version info does not go into the input field. Same for other values where we have version specific default values.

Suggested change

'Reduce event volume by merging related process events into fewer aggregate events. Default: <=8.17: false, >=8.18: true.',

'Reduce event volume by merging related process events into fewer aggregate events. For <=8.17, Default: false. For >=8.18, Default: true.',

Why not make it even simpler by saying For 8.17 and below, Default: false. For 8.18 and greater Default: true.

@natasha-moore-elastic do you have an opinion here?

Agree that this would be easier to read. I'd suggest:

For 8.17 and earlier, default: false. For 8.18 and later, default: true.

👍 I updated all options with similar text. e70d2ad

ashokaditya · 2025-09-29T11:43:40Z

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

@@ -1003,7 +1017,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
      'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.memory_protection.enable_shared_dirty_scan',
      {
        defaultMessage:
-          'Instead of ignoring regions with just no Private_Dirty bytes, ingore regions with the combination of no Private_Dirty bytes, no Shared_Dirty bytes and is file backed. This has the effect of scanning more memory regions because of the loosened restrictions. Default: true.',
+          "Instead of ignoring regions with just no 'Private_Dirty' bytes, ignore regions with the combination of no 'Private_Dirty' bytes, no 'Shared_Dirty' bytes and is file-backed. This has the effect of scanning more memory regions because of the loosened restrictions. Default: true.",


I am not sure if this explains how to use the input values correctly. Is ignoring memory regions is achieved by not adding Private_Dirty in the input filed? or no Private_Dirty in the input field. Also I think the message should say Instead of ignoring memory regions....?

I updated the wording to say "...ignoring memory regions...". The input type is a boolean, which is implied by Default: true. as we normally do.

…options

ferullo · 2025-10-28T18:09:22Z

Thanks for all your feedback @ashokaditya . @dasansol92 @ashokaditya I let this PR fall dormant in the run up to 9.2 so I didn't cause conflicts for others, but it's ready for review (again) now.

Please review the backport label and let me know if it should change.

…to align-advanced-options

Co-authored-by: Ash <[email protected]>

ferullo · 2025-10-30T17:10:07Z

I would suggest that we get someone from the docs team to proof read the copy changes here.

Sorry @ashokaditya I just noticed this bit. These changes are to align Kibana with the text for this online page, which was proofread by the docs team. So that has happened.

There are a lot of changes in this PR already. Once it merges I'll follow up with another, smaller batch of changes -- again to align with the docs-team-approved online documentation.

ashokaditya · 2025-11-03T13:19:52Z

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts

@@ -152,7 +156,7 @@ export const AdvancedPolicySchema: AdvancedPolicySchemaType[] = [
      'xpack.securitySolution.endpoint.policy.advanced.linux.advanced.logging.file',
      {
        defaultMessage:
-          'A supplied value will override the log level configured for logs that are saved to disk and streamed to Elasticsearch. It is recommended Fleet be used to change this logging in most circumstances. Allowed values are error, warning, info, debug, and trace.',
+          "Override the log level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",


I see. I would then suggest that we use ...log setting... or just setting instead of ...logging setting.... Same suggestion for all other changes that use similar phrasing.

ashokaditya · 2025-11-03T15:07:01Z

Please review the backport label and let me know if it should change.

I don't see any backport labels on the PR yet. Do we want to backport this to 9.2?

ferullo · 2025-11-03T17:37:34Z

Thanks for review.

I don't see any backport labels on the PR yet. Do we want to backport this to 9.2?

I don't think we need to backport this.

dasansol92 · 2025-11-11T09:35:10Z

@elasticmachine merge upstream

…to align-advanced-options

elasticmachine · 2025-11-11T20:59:22Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.0MB	11.0MB	-45.0B

History

💔 Build #360259 failed 33bae0b
💔 Build #360083 failed cc9e29f
💔 Build #356811 failed 45faa2a
💚 Build #356262 succeeded 2f6ad27
💔 Build #355949 failed 4815664

…entation (elastic#230269) ## Summary This aligns the tool-tips shown in Kibana to the same Docs-Team-approved-text on https://www.elastic.co/docs/reference/security/defend-advanced-settings (including a few pending updates in elastic/docs-content#2365). One new advanced option is added. It's been missing from Kibana -- it isn't new. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) ### Identify risks No risk assuming this renders right in Kibana. It's just tool-tip wording changes. --------- Co-authored-by: Ash <[email protected]> Co-authored-by: Elastic Machine <[email protected]>

cleanup

98cb8a4

ferullo added release_note:skip Skip the PR/issue when compiling release notes ci:cloud-deploy Create or update a Cloud deployment labels Aug 1, 2025

ferullo commented Aug 1, 2025

View reviewed changes

ferullo added 3 commits August 1, 2025 13:11

Merge branch 'main' into align-advanced-options

b74a89b

Merge branch 'main' into align-advanced-options

4e04999

Merge branch 'main' into align-advanced-options

6bc5581

ferullo commented Sep 3, 2025

View reviewed changes

...ty/plugins/security_solution/public/management/pages/policy/models/advanced_policy_schema.ts Outdated Show resolved Hide resolved

ferullo and others added 8 commits September 3, 2025 10:11

Update x-pack/solutions/security/plugins/security_solution/public/man…

5be8b8b

…agement/pages/policy/models/advanced_policy_schema.ts

Merge branch 'main' into align-advanced-options

b378b8f

Merge branch 'main' into align-advanced-options

7cefec7

Merge branch 'main' into align-advanced-options

4b07128

remove backticks

d59585a

Merge branch 'main' into align-advanced-options

71920d3

fix typos

f8b0716

Merge branch 'align-advanced-options' of github.com:ferullo/kibana in…

90b5842

…to align-advanced-options

ferullo marked this pull request as ready for review September 15, 2025 18:26

ferullo requested a review from a team as a code owner September 15, 2025 18:26

ferullo requested review from ashokaditya and szwarckonrad September 15, 2025 18:26

Merge branch 'main' into align-advanced-options

32016b2

ferullo requested review from dasansol92 and removed request for szwarckonrad September 15, 2025 18:26

ferullo and others added 3 commits September 16, 2025 10:06

Merge branch 'main' of github.com:elastic/kibana into align-advanced-…

744e753

…options

lint

b3a6adb

Merge branch 'main' into align-advanced-options

0495064

ferullo added backport:skip This PR does not require backporting ci:cloud-deploy Create or update a Cloud deployment and removed ci:cloud-deploy Create or update a Cloud deployment labels Sep 16, 2025

Merge branch 'main' into align-advanced-options

0162be5

ashokaditya reviewed Sep 29, 2025

View reviewed changes

ferullo added 4 commits October 28, 2025 13:53

Merge branch 'main' of github.com:ferullo/kibana into align-advanced-…

ebb2898

…options

Merge branch 'main' of github.com:elastic/kibana into align-advanced-…

92702da

…options

update wording for 2 options

4caa470

minor wording changes

1e8d77b

ferullo and others added 5 commits October 28, 2025 15:41

Merge branch 'main' into align-advanced-options

4815664

Merge branch 'main' into align-advanced-options

2f6ad27

apply feedback on wording for differing defaults across versions

e70d2ad

Merge branch 'align-advanced-options' of github.com:ferullo/kibana in…

5ea6dd0

…to align-advanced-options

Apply suggestions from code review

45faa2a

Co-authored-by: Ash <[email protected]>

ashokaditya approved these changes Nov 3, 2025

View reviewed changes

dasansol92 requested a review from natasha-moore-elastic November 10, 2025 14:30

natasha-moore-elastic approved these changes Nov 10, 2025

View reviewed changes

dasansol92 approved these changes Nov 11, 2025

View reviewed changes

elasticmachine and others added 5 commits November 11, 2025 10:35

Merge branch 'main' into align-advanced-options

cc9e29f

fix . that should be a ,

052869b

Merge branch 'align-advanced-options' of github.com:ferullo/kibana in…

33bae0b

…to align-advanced-options

fix remaining stray .

150a0b8

Merge branch 'main' into align-advanced-options

e88b19d

ferullo merged commit 58617f9 into elastic:main Nov 12, 2025
12 checks passed

ferullo deleted the align-advanced-options branch November 12, 2025 13:32

kibanamachine added the v9.3.0 label Nov 12, 2025

	"Override the log level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",
	"Override the logging level configured for logs that are saved to disk and streamed to Elasticsearch. Elastic recommends using Fleet to change this logging setting in most circumstances. Allowed values are 'error', 'warning', 'info', 'debug', and 'trace'. Default: Fleet configuration is used.",

	'Reduce event volume by merging related process events into fewer aggregate events. Default: <=8.17: false, >=8.18: true.',
	'Reduce event volume by merging related process events into fewer aggregate events. For <=8.17, Default: false. For >=8.18, Default: true.',

[EDR Workflows] Align advanced option tool-tips with elastic.co documentation #230269

[EDR Workflows] Align advanced option tool-tips with elastic.co documentation #230269

Uh oh!

Conversation

ferullo commented Aug 1, 2025

Summary

Checklist

Identify risks

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Sep 15, 2025

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ferullo commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ferullo commented Oct 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ferullo commented Nov 3, 2025

Uh oh!

dasansol92 commented Nov 11, 2025

Uh oh!

elasticmachine commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Metrics [docs]

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ferullo commented Oct 28, 2025 •

edited

Loading

ashokaditya commented Nov 3, 2025 •

edited

Loading

elasticmachine commented Nov 11, 2025 •

edited

Loading