Add additional exceptionable_endpoint_fields as suggested

elastic · Jul 12, 2021 · 571902e · 571902e
1 parent f1f968f
commit 571902e
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.../security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json b/.../security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
@@ -2,10 +2,12 @@
   "Endpoint.policy.applied.id",
   "Target.process.Ext.services",
   "Target.process.Ext.user",
+  "Target.process.executable",
   "Target.process.hash.md5",
   "Target.process.hash.sha1",
   "Target.process.hash.sha256",
   "Target.process.hash.sha512",
+  "Target.process.name",
   "Target.process.parent.hash.md5",
   "Target.process.parent.hash.sha1",
   "Target.process.parent.hash.sha256",
@@ -24,6 +26,7 @@
   "Target.process.thread.Ext.start_address_details.region_size",
   "Target.process.thread.Ext.start_address_details.region_protection",
   "Target.process.thread.Ext.start_address_details.memory_pe.imphash",
+  "Target.process.thread.Ext.start_address_bytes",
   "agent.id",
   "agent.type",
   "agent.version",
@@ -75,10 +78,13 @@
   "host.type",
   "process.Ext.services",
   "process.Ext.user",
+  "process.Ext.code_signature",
+  "process.executable",
   "process.hash.md5",
   "process.hash.sha1",
   "process.hash.sha256",
   "process.hash.sha512",
+  "process.name",
   "process.parent.hash.md5",
   "process.parent.hash.sha1",
   "process.parent.hash.sha256",