New page about allowlisting Elastic Endpoint in 3rd-party AV software

docs/management/admin/allowlist-endpoint-3rd-party-av.asciidoc

@@ -0,0 +1,53 @@
+[[allowlist-endpoint-3rd-party-av-apps]]
+= Allowlist Elastic Endpoint in third-party antivirus apps
+
+Third-party antivirus (AV) applications may identify the expected behavior of {elastic-endpoint} as a potential threat. Add {elastic-endpoint}'s digital signatures and file paths to your AV software's allowlist to ensure {elastic-endpoint} continues to function as intended. 
+
+NOTE: Your AV software may refer to allowlisted processes as process exclusions, ignored processes, or trusted processes.
+
+NOTE: We recommend you allowlist both the file paths and digital signatures, if applicable. 
+
+[discrete]
+== Allowlist {elastic-endpoint} on Windows
+
+File paths:
+
+* ELAM driver: `c:\Windows\system32\drivers\elastic-endpoint-driver.sys (ELAM driver)`
+* Driver: `c:\Windows\system32\drivers\ElasticElam.sys`
+* Executable: `c:\Program Files\Elastic\Endpoint\elastic-endpoint.exe`
++
+NOTE: The executable runs as `elastic-endpoint.exe`
+
+Digital signatures:
+
+* `Elasticsearch, Inc.`
+* `Elasticsearch B.V.`
+
+For additional information about allowlisting on Windows, refer to https://github.com/elastic/endpoint/blob/main/PerformanceIssues-Windows.md#trusting-elastic-defend-in-other-software[Trusting Elastic Defend in other software].
+
+[discrete]
+== Allowlist {elastic-endpoint} on macOS
+
+File paths:
+
+* System extension (recursive directory structure): `/Applications/ElasticEndpoint.app/`
++
+NOTE: The system extension runs as `co.elastic.systemextension`.
+
+* Executable: `/Library/Elastic/Endpoint/elastic-endpoint`
++
+NOTE: The executable runs as `elastic-endpoint.exe`.
+
+Digital signatures:
+
+* Authority/Developer ID Application: `Elasticsearch, Inc (2BT3HPN62Z)`
+* Team ID: `2BT3HPN62Z`
+
+[discrete]
+== Allowlist {elastic-endpoint} on Linux
+
+File path:
+
+* Executable: `/opt/Elastic/Endpoint/elastic-endpoint`
++
+NOTE: The executable runs as `elastic-endpoint`

docs/management/manage-intro.asciidoc

@@ -15,3 +15,4 @@ include::{security-docs-root}/docs/management/admin/event-filters.asciidoc[level
 include::{security-docs-root}/docs/management/admin/host-isolation-exceptions.asciidoc[leveloffset=+1]
 include::{security-docs-root}/docs/management/admin/blocklist.asciidoc[leveloffset=+1]
 include::{security-docs-root}/docs/management/admin/endpoint-artifacts.asciidoc[leveloffset=+1]
+include::{security-docs-root}/docs/management/admin/allowlist-endpoint-3rd-party-av.asciidoc[leveloffset=+1]