From 111ae1537f529fc797dfaf12e645073a823ad101 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Wed, 28 Oct 2026 18:58:20 +0000 Subject: [PATCH 1/3] [Security] 8.19.24 release notes Co-authored-by: Cursor --- docs/release-notes.asciidoc | 1 + docs/release-notes/8.19.asciidoc | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/docs/release-notes.asciidoc b/docs/release-notes.asciidoc index e9ee26f26c..e945ff39f1 100644 --- a/docs/release-notes.asciidoc +++ b/docs/release-notes.asciidoc @@ -3,6 +3,7 @@ This section summarizes the changes in each release. +* <> * <> * <> * <> diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index 1ea6e384a8..0dc3f0e3c7 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -1,6 +1,27 @@ [[release-notes-header-8.19.0]] == 8.19 +[discrete] +[[release-notes-8.19.24]] +=== 8.19.24 + +[discrete] +[[enhancements-8.19.24]] +==== Enhancements +* Refactors how {elastic-defend} manages the macOS system extension to improve reliability. + +[discrete] +[[bug-fixes-8.19.24]] +==== Fixes +* Fixes an issue where prebuilt rules were flagged as customized, and showed non-solvable `required_fields` upgrade conflicts, even though you hadn't edited the field. Also improves the performance of the rule edit form and the upgrade flyout for rules with long `required_fields` lists ({kibana-pull}294946[#294946]). +* Fixes the detection rules bulk delete action (`POST /api/detection_engine/rules/_bulk_action`) returning HTTP 500 when a targeted rule was already deleted, for example by a concurrent request. These rules are now reported as skipped with a `RULE_NOT_FOUND` reason, and the response is HTTP 200 ({kibana-pull}287003[#287003]). +* Fixes the `get-file` response action so {elastic-defend} no longer fails the action as host unreachable when a TLS handshake fails due to a broken connection. +* Fixes a startup crash on macOS that occurred when {elastic-defend} could not determine the OS version. +* Fixes an issue where {elastic-defend} could negotiate a different TLS cipher suite from the one configured, or reject a valid cipher suite name, when the output's `ssl.cipher_suites` setting used Beats-style names for two CBC cipher suites. `ECDHE-RSA-AES-128-CBC-SHA256` was resolving to `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` instead of `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, and `RSA-AES-128-CBC-SHA256` and `ECDHE-RSA-AES-256-CBC-SHA` were rejected. +* Improves {elastic-defend} memory threat protection on macOS 27. +* Updates the {elastic-defend} `get-file` response action to return a symbolic link as a regular file with the content of the file the link points to, and on Linux and macOS with that file's permissions. Previously, some extraction tools, such as `unzip`, created a link instead of the file, or skipped it. +* Fixes caseless comparison in {elastic-defend} so it ignores case for non-ASCII letters, such as Cyrillic, Greek, or accented Latin. + [discrete] [[release-notes-8.19.23]] === 8.19.23 From 7812d3152e9246ad803f420f1a534f58ba58dd81 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Thu, 29 Oct 2026 12:06:09 +0000 Subject: [PATCH 2/3] Update docs/release-notes/8.19.asciidoc Co-authored-by: Reinaldo Araque <3694682+jr-araque@users.noreply.github.com> --- docs/release-notes/8.19.asciidoc | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index 0dc3f0e3c7..7c04668c80 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -14,7 +14,6 @@ [[bug-fixes-8.19.24]] ==== Fixes * Fixes an issue where prebuilt rules were flagged as customized, and showed non-solvable `required_fields` upgrade conflicts, even though you hadn't edited the field. Also improves the performance of the rule edit form and the upgrade flyout for rules with long `required_fields` lists ({kibana-pull}294946[#294946]). -* Fixes the detection rules bulk delete action (`POST /api/detection_engine/rules/_bulk_action`) returning HTTP 500 when a targeted rule was already deleted, for example by a concurrent request. These rules are now reported as skipped with a `RULE_NOT_FOUND` reason, and the response is HTTP 200 ({kibana-pull}287003[#287003]). * Fixes the `get-file` response action so {elastic-defend} no longer fails the action as host unreachable when a TLS handshake fails due to a broken connection. * Fixes a startup crash on macOS that occurred when {elastic-defend} could not determine the OS version. * Fixes an issue where {elastic-defend} could negotiate a different TLS cipher suite from the one configured, or reject a valid cipher suite name, when the output's `ssl.cipher_suites` setting used Beats-style names for two CBC cipher suites. `ECDHE-RSA-AES-128-CBC-SHA256` was resolving to `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` instead of `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, and `RSA-AES-128-CBC-SHA256` and `ECDHE-RSA-AES-256-CBC-SHA` were rejected. From 4039ea75005d45341d6d3d3628ed61111d135380 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Thu, 29 Oct 2026 14:43:50 +0000 Subject: [PATCH 3/3] Apply batched suggestions from code review Co-authored-by: gogochan <5281995+gogochan@users.noreply.github.com> --- docs/release-notes/8.19.asciidoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index 7c04668c80..309c109705 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -8,7 +8,7 @@ [discrete] [[enhancements-8.19.24]] ==== Enhancements -* Refactors how {elastic-defend} manages the macOS system extension to improve reliability. +* Improves the reliability of macOS system extension management in {elastic-defend}. [discrete] [[bug-fixes-8.19.24]] @@ -16,9 +16,9 @@ * Fixes an issue where prebuilt rules were flagged as customized, and showed non-solvable `required_fields` upgrade conflicts, even though you hadn't edited the field. Also improves the performance of the rule edit form and the upgrade flyout for rules with long `required_fields` lists ({kibana-pull}294946[#294946]). * Fixes the `get-file` response action so {elastic-defend} no longer fails the action as host unreachable when a TLS handshake fails due to a broken connection. * Fixes a startup crash on macOS that occurred when {elastic-defend} could not determine the OS version. -* Fixes an issue where {elastic-defend} could negotiate a different TLS cipher suite from the one configured, or reject a valid cipher suite name, when the output's `ssl.cipher_suites` setting used Beats-style names for two CBC cipher suites. `ECDHE-RSA-AES-128-CBC-SHA256` was resolving to `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` instead of `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, and `RSA-AES-128-CBC-SHA256` and `ECDHE-RSA-AES-256-CBC-SHA` were rejected. +* Fixes an issue where {elastic-defend} could negotiate a different TLS cipher suite than configured, or reject a valid one, when `ssl.cipher_suites` used the Beats-style names `ECDHE-RSA-AES-128-CBC-SHA256`, `RSA-AES-128-CBC-SHA256`, or `ECDHE-RSA-AES-256-CBC-SHA`. * Improves {elastic-defend} memory threat protection on macOS 27. -* Updates the {elastic-defend} `get-file` response action to return a symbolic link as a regular file with the content of the file the link points to, and on Linux and macOS with that file's permissions. Previously, some extraction tools, such as `unzip`, created a link instead of the file, or skipped it. +* Updates the {elastic-defend} `get-file` response action to return a symbolic link as a regular file with the content of the file the link points to, and on Linux and macOS with that file's permissions. * Fixes caseless comparison in {elastic-defend} so it ignores case for non-ASCII letters, such as Cyrillic, Greek, or accented Latin. [discrete]