diff --git a/docs/release-notes/8.9.asciidoc b/docs/release-notes/8.9.asciidoc
index b057eb8f72..cf315a77d3 100644
--- a/docs/release-notes/8.9.asciidoc
+++ b/docs/release-notes/8.9.asciidoc
@@ -147,6 +147,7 @@ There are no breaking changes in 8.9.0.
 [discrete]
 [[features-8.9.0]]
 ==== New features
+* Introduces the `top` command for MacOS and Linux, which shows active processes that {elastic-endpoint} is monitoring and recording. Processes are sorted by how much CPU they are causing {elastic-endpoint} to consume. Learn more about the `top` command by referring to the (https://www.github.com/elastic/endpoint/blob/main/EndpointTopCommand.md[readme]).
 * Allows you to install the Cloud Security Posture Management (CSPM) integration via CloudFormation ({pull}159994[#159994]).
 * Creates a new dashboard, Cloud Native Vulnerability Management, that provides an overview of vulnerabilities on your cloud hosts ({pull}159699[#159699]).
 * Allows you to group vulnerabilities by resource (host) on the Vulnerabilities Findings page, and creates a Resource flyout that displays detailed vulnerability findings for individual hosts ({pull}159873[#159873], {pull}158987[#158987]).