[Security Solution] Filterlist Update for Endpoint Events

[AsuNa-jp]

Summary

Updates endpoint alerts telemetry filter list to add the following new fields for the process/dll events.

• origin_referrer_url
• origin_url

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/esecurity-onboarding-and-lifecycle-mgt (Feature:Endpoint)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7df7ff1

Metrics [docs]

✅ unchanged

History

• 💚 Build #295601 succeeded 0044d2b
• 💛 Build #295275 was flaky 6e13e25

cc @AsuNa-jp

[AsuNa-jp]

Thank you very much for creating this PR!

My PR adds the origin_referrer_url and origin_url fields to the filterlist for both process and DLL events.
and, it looks like dll.origin_referrer_url and dll.origin_url have been properly added to the manifest file. Thank you!

For the process event, if my understanding is correct, it seems that we also need to add origin_referrer_url and origin_url to the following as well. (That said, I’m not an expert on the filter list or the manifest myself, so please don’t hesitate to correct me if I’m wrong.)

For your reference

For the process events, I’ve added the origin_referrer_url and origin_url fields as shown below.

// Allow list process fields within events.  This includes "process" and "Target.process".'
const baseAllowlistFields: AllowlistFields = {
  args: true,
  entity_id: true,
  name: true,
  executable: true,
  code_signature: true,
  command_line: true,
  env_vars: true,
  hash: true,
  pid: true,
  pe: true,
  uptime: true,
  origin_referrer_url: true,
  origin_url: true,
  Ext: {

[szaffarano]

Hi @AsuNa-jp
baseAllowlistFields is reused in a few places to create the effective filterlist json, so your changes apply to

• process
• process.parent
• target.process.parent
• target.process

In other words, it applies to:

{
  "process": {
    "parent": {
      "origin_referrer_url": "..",
      "origin_url": "..."
    },
    "origin_referrer_url": "..",
    "origin_url": "..."
  },
  "target": {
    "process": {
      "parent": {
        "origin_referrer_url": "..",
        "origin_url": "..."
      }
    },
    "origin_referrer_url": "..",
    "origin_url": "..."
  }
}

I think it was what you wanted to change, right?
If you want, you can share an example JSON doc, and I can apply the filter list to show you the outcome.

[kibanamachine]

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/14641284596

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation