Skip to content

Adds trusted descendants option for Trusted Applications #4399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
benironside wants to merge 2 commits into
base: main
Choose a base branch
from
+5 −4
Draft

Adds trusted descendants option for Trusted Applications #4399

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40e05d0
Adds trusted descendants option for Trusted Applications
benironside Dec 17, 2025
e2ca6ff
Update trusted-applications.md
benironside Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions solutions/security/manage-elastic-defend/trusted-applications.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,9 @@ To add a trusted application:
Define more complex conditions, such as trusting specific file paths or remote IP addresses.

1. `Select operating system`: Select the appropriate operating system from the drop-down.
2. `Field`: Select a field to identify the trusted application.
3. `Operator`: Select an operator to define the condition:
2. {applies_to}`stack: ga 9.3`{applies_to}`serverless: ga`(Optional) Turn on the `Process Descendants` toggle to make your exception apply to processes that are descendants of your new trusted application.
3. `Field`: Select a field to identify the trusted application.
4. `Operator`: Select an operator to define the condition:
* `is`
* `is not`
* `is one of`
Expand All @@ -100,8 +101,8 @@ To add a trusted application:
Using wildcards can impact performance. To create a more efficient trusted application using wildcards, use multiple conditions and make them as specific as possible. For example, adding conditions using `process.name` or `file.name` can help limit the scope of wildcard matching.
::::

4. `Value`: Enter the value associated with the `Field`. To enter multiple values (when using `is one of` or `is not one of`), enter each value, then press **Return**.
5. To define multiple conditions, click `AND` and configure a new condition. You can also add nested conditions by selecting `Add nested condition`.
5. `Value`: Enter the value associated with the `Field`. To enter multiple values (when using `is one of` or `is not one of`), enter each value, then press **Return**.
6. To define multiple conditions, click `AND` and configure a new condition. You can also add nested conditions by selecting `Add nested condition`.

:::::

Expand Down
Loading