diff --git a/docs/release-notes.asciidoc b/docs/release-notes.asciidoc index fe725ec25d..00a0a2c933 100644 --- a/docs/release-notes.asciidoc +++ b/docs/release-notes.asciidoc @@ -3,6 +3,7 @@ This section summarizes the changes in each release. +* <> * <> * <> * <> diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index 38e4544384..5d1c962f25 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -1,6 +1,38 @@ [[release-notes-header-8.19.0]] == 8.19 +[discrete] +[[release-notes-8.19.20]] +=== 8.19.20 + +[discrete] +[[enhancements-8.19.20]] +==== Enhancements + +* Defaults the {ls} output port to `5044` in {elastic-defend} when no port is provided. + +[discrete] +[[bug-fixes-8.19.20]] +==== Fixes +* Fixes an issue where the **Source event** link in an alert's **Highlighted fields** section failed to open the document when it lived in a hidden restored or partial index ({kibana-pull}282272[#282272]). +* Fixes a privilege bypass that allowed users with detection rule privileges to attach {elastic-defend} or Osquery response actions through the generic Alerting API without the required Endpoint or Osquery privileges ({kibana-pull}280430[#280430]). +* Fixes the analyzer alert-hits query so it honors the `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting, which previously excluded cold and frozen tiers only from other analyzer queries ({kibana-pull}278972[#278972]). +* Fixes a crash when opening the rule panel flyout for a deleted rule caused by missing `severity_mapping` or `risk_score_mapping` fields ({kibana-pull}278545[#278545]). +* Fixes an issue where {kib} assets from an installed integration package (such as dashboards used by prebuilt detection rules) could remain stale across a {kib} upgrade because {fleet} never overwrote existing assets on reinstall ({kibana-pull}277953[#277953]). +* Fixes a crash in index fields formatting when a field or index is named after an `Object.prototype` property such as `constructor`, `toString`, or `__proto__` ({kibana-pull}277851[#277851]). +* Fixes an error when opening a source event from the **Highlighted fields** section of the alert details flyout when the source index had been restored, and renamed, from a cold or frozen tier ({kibana-pull}277703[#277703]). +* Fixes an issue where the `concurrent_searches` and `items_per_search` API fields for `threat_match` (Indicator Match) rules were reset to their defaults when the rule was saved through the UI ({kibana-pull}276823[#276823]). +* Fixes **Investigate in Timeline** for Indicator Match alerts by quoting and escaping KQL values that contain reserved characters, such as `:` in URLs ({kibana-pull}271639[#271639]). +* Fixes an issue where {elastic-defend} WFP firewall anti-tamper rules were not reinstated after a restart when the policy had not changed. +* Fixes a CPU spin loop in {elastic-defend} that could occur when a middlebox (such as Zscaler or a load balancer) dropped a TLS connection to the {ls} or {es} output with a TCP RST, pinning one CPU core and preventing event delivery until the agent was restarted. +* Fixes an issue where {elastic-defend} immediately retried sending documents when {es} failed to ingest them. +* Fixes {elastic-defend} on Windows so TLS handshakes succeed against servers that send a leaf-only certificate chain when the issuing intermediate CA is installed in the Windows Intermediate CA store, matching the behavior of other Elastic components. +* Fixes an issue in {elastic-defend} on Windows where the Windows Intermediate CA store was loaded into OpenSSL's trust anchor store alongside Trusted Root CAs. On hosts with cross-signed CA certificates sharing identical Subject/Issuer distinguished names, this could cause TLS handshake failures with a "certificate chain too long" error against otherwise valid certificate chains. +* Fixes {elastic-defend} notifications not appearing on macOS Sonoma and later. +* Fixes an {agent} upgrade issue caused by an {elastic-defend} verify command failure that logged `Unable to start endpoint to check version: exit status 2, try install` every 30 seconds on affected endpoints. +* Fixes a resource leak in {elastic-defend} Lua libraries. +* Preserves source and destination details for outbound IPv6 TCP connections in {elastic-defend} on Linux. + [discrete] [[release-notes-8.19.19]] === 8.19.19