Users can set a kill/suspend process response action with a detection rule configuration

[caitlinbetz]

Description

We are expanding the existing native response action functionality available with detection rule creation (see existing docs here) to include the kill and suspend process actions. This will allow users to create a rule that will automatically kill or suspend a suspicious or malicious process, automatically stopping the execution of malicious activities, eliminating the need for manual intervention, and speeding up overall time to respond.

Background & resources

• PRs:
  • [Defend Workflows] Add support for Processes commands in Automated Response Actions  kibana#161645
  • [EDR Workflows] Copy changes kibana#176479
• Issues/metas:
  • https://github.com/elastic/security-team/issues/4232
  • Also related:
    • https://github.com/elastic/security-team/issues/7460
    • https://github.com/elastic/security-team/issues/8561
• Point of contact:
  • @caitlinbetz @tomsonpl
• Test environments:

Condensed docs issue template info

• Which documentation set does this change impact? ESS and serverless
• ESS release: 8.13
• Serverless release: week of March 26, 2024
• Feature differences: N/A
• API docs impact: @tomsonpl

Prerequisites, privileges, feature flags

• Enterprise feature
• Privileges:
  • process response actions privilege
  • ability to create rules
• Feature flag: automatedProcessActionsEnabled
  • Release to serverless: [EDR Workflows] Enable 8.13 feature flags to serverless kibana#179316

---

Docs Pull Requests

Preview Give feedback

1. Classic docs — Automated endpoint response actions on rules (kill/suspend process) #4890
2. Serverless docs — https://github.com/elastic/staging-serverless-security-docs/pull/305