From 5fb37a6376158b732fa34b9f19bb4b4f2dba2672 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Wed, 27 Nov 2024 20:42:19 +0000 Subject: [PATCH] Signature option available for macOS Trusted Apps conditions (#6183) --- docs/management/admin/trusted-apps.asciidoc | 2 +- docs/serverless/edr-manage/trusted-apps-ov.asciidoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/management/admin/trusted-apps.asciidoc b/docs/management/admin/trusted-apps.asciidoc index 9a15767810..0f9ae88b36 100644 --- a/docs/management/admin/trusted-apps.asciidoc +++ b/docs/management/admin/trusted-apps.asciidoc @@ -37,7 +37,7 @@ To add a trusted application: * `Field`: Select a field to identify the trusted application: ** `Hash`: The MD5, SHA-1, or SHA-256 hash value of the application's executable. ** `Path`: The full file path of the application's executable. -** `Signature`: (Windows only) The name of the application's digital signer. +** `Signature`: (Windows and macOS only) The name of the application's digital signer. + TIP: To find the signer's name for an application, go to *Kibana* -> *Discover* and query the process name of the application's executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer's name (for example, `McAfee, Inc.`). diff --git a/docs/serverless/edr-manage/trusted-apps-ov.asciidoc b/docs/serverless/edr-manage/trusted-apps-ov.asciidoc index c7c05e9095..5c55b6f1f6 100644 --- a/docs/serverless/edr-manage/trusted-apps-ov.asciidoc +++ b/docs/serverless/edr-manage/trusted-apps-ov.asciidoc @@ -42,7 +42,7 @@ To add a trusted application: + *** `Hash`: The MD5, SHA-1, or SHA-256 hash value of the application's executable. *** `Path`: The full file path of the application's executable. -*** `Signature`: (Windows only) The name of the application's digital signer. +*** `Signature`: (Windows and macOS only) The name of the application's digital signer. + [TIP] ====