[BUG] Endpoint Trusted Applications docs need to mention that process events will always be generated

[ferullo]

Description: The Endpoint Trusted Applications documentation doesn't mention that processes that match Trusted Applications still intentionally generate process create and terminate events that are written to Elasticsearch. This is done to preserve process lineage information in the stack, which for instance is used to render Analyze Events graphs. Can we get the document updated to clear up this confusion?

If a user does want to prevent process create and terminate events for Trusted Applications from being written to Elasticsearch they can use a Event Filter to suppress them.

Doc URL link or topic name: https://www.elastic.co/guide/en/security/current/trusted-apps-ov.html

---

Pull requests

Tasks

Preview Give feedback

1. Classic docs — [BUG] Endpoint Trusted Applications docs need to mention that process events will always be generated (Classic docs) #4640
2. Serverless docs — https://github.com/elastic/staging-serverless-security-docs/pull/272

[ferullo]

cc @nfritts @nicholasberlin @gabriellandau

[caitlinbetz]

thanks @ferullo , we mention this briefly on the Optimize Defend page - but it would be beneficial to include those bullets in the respective artifact main pages.

[joepeeples]

Serverless OK to publish whenever content is ready