8.15.0 Release notes

docs/release-notes.asciidoc

@@ -3,6 +3,7 @@
 
 This section summarizes the changes in each release.
 
+* <<release-notes-8.15.0, {elastic-sec} version 8.15.0>>
 * <<release-notes-8.14.3, {elastic-sec} version 8.14.3>>
 * <<release-notes-8.14.2, {elastic-sec} version 8.14.2>>
 * <<release-notes-8.14.2, {elastic-sec} version 8.14.2>>
@@ -61,6 +62,7 @@ This section summarizes the changes in each release.
 * <<release-notes-8.0.0, {elastic-sec} version 8.0.0>>
 * <<release-notes-8.0.0-rc2, {elastic-sec} version 8.0.0-rc2>>
 
+include::release-notes/8.15.asciidoc[]
 include::release-notes/8.14.asciidoc[]
 include::release-notes/8.13.asciidoc[]
 include::release-notes/8.12.asciidoc[]

docs/release-notes/8.15.asciidoc

@@ -0,0 +1,62 @@
+[[release-notes-header-8.15.0]]
+== 8.15
+
+[discrete]
+[[release-notes-8.15.0]]
+=== 8.15.0
+
+[discrete]
+[[breaking-changes-8.15.0]]
+==== Breaking changes
+
+* User-defined quick prompts for Elastic AI Assistant that were created before you upgrade to 8.15 will no longer appear after you upgrade. In 8.15, quick prompts will be shared by all users in your deployment, rather than stored at the user level. To implement your existing quick prompts in 8.15, copy them prior to upgrade, and add them again after upgrade ({kibana-pull}187040[#187040]).
+
+[discrete]
+[[features-8.15.0]]
+==== New features
+
+* Adds the `scan` action to the response console, which allows you to scan a specific file or directory on a host for malware ({kibana-pull}184723[#184723]).
+* Adds an {elastic-defend} integration policy option in Advanced Settings that allows you to opt out of registry event filtering ({kibana-pull}186564[#186564]).
+* Allows you to specify additional file and registry paths to monitor for read access ({kibana-pull}181361[#181361]).
+* Allows you to use {elastic-sec} to isolate and release hosts running a CrowdStrike agent ({kibana-pull}186801[#186801]).
+* Allows you to retrieve files from SentinelOne-enrolled hosts ({kibana-pull}181162[#181162]).
+* Allows you to create an event filter that excludes the descendant events of a specific process ({kibana-pull}184947[#184947]).
+* Recalculates entity risk scores when asset criticality changes on an individual entity ({kibana-pull}182234[#182234]).
+* Allows you to edit the `max_signals`, `related_integrations`, and `required_fields` fields for custom rules ({kibana-pull}179680[#179680], {kibana-pull}178295[#178295], {kibana-pull}180682[#180682]).
+* Provides help from AI Assistant when you're correcting rule query errors ({kibana-pull}179091[#179091]).  
+* Allows you to bulk update custom highlighted fields for rules ({kibana-pull}179312[#179312]).
+* Adds alert suppression for {ml} and {esql} rules ({kibana-pull}181926[#181926], {kibana-pull}180927[#180927]).
+* Provides previews of hosts, users, and alerts that you're examining in the alert details flyout ({kibana-pull}186850[#186850], {kibana-pull}186857[#186857]).
+* Adds an option for toggling row renderers on and off, and moves notes to a new flyout in Timeline ({kibana-pull}186948[#186948]).
+
+[discrete]
+[[enhancements-8.15.0]]
+==== Enhancements
+
+* Adds notifications to the connector dropdown menu on the **Attack discovery** page so you know when other connectors have new discoveries ({kibana-pull}186903[#186903], {kibana-pull}187209[#187209]).
+* Improves the output of discoveries generated with `GPT-4o` ({kibana-pull}187183[#187183]).
+* Allows Attack discovery generation to continue when you navigate to another page ({kibana-pull}184949[#184949]).
+* Improves AI Assistant responses across multiple connectors and in multiple scenarios, for both streaming and non-streaming use cases ({kibana-pull}182041[#182041]).
+* Updates the default Gemini version to `gemini-1.5-pro-001` and the default Bedrock version to `anthropic.claude-3-5-sonnet-20240620-v1:0` ({kibana-pull}186671[#186671]).
+* Introduces a new {elastic-endpoint} policy setting that allows you to control whether the kernel reports Windows network events that happened on a local loopback interface ({kibana-pull}181753[#181753]).
+* Improves how failure messages for the `scan` action appear in the response console ({kibana-pull}186284[#186284]).
+* Improves the risk engine's performance. Now, after you turn on the engine, risk data is available sooner ({kibana-pull}184797[#184797]).
+* Enhances the risk engine's normalization accuracy ({kibana-pull}184638[#184638]).
+* Updates the copy for bulk assigning asset criticality to multiple entities ({kibana-pull}181390[#181390]).
+* Improves visual and logic issues in the Findings table ({kibana-pull}184185[#184185]).
+* Enables the expandable alert details flyout by default and replaces the `securitySolution:enableExpandableFlyout` advanced setting with a feature flag that allows you to revert to the old version of the flyout ({kibana-pull}184169[#184169]).
+* Updates the MITRE ATT&CK framework to version 15.1 ({kibana-pull}183463[#183463]).
+* Improves the warning message about rule actions being unavailable after a rule ran ({kibana-pull}182741[#182741]).
+* Enables the `xMatters` and `Server Log connectors` rule actions ({kibana-pull}172933[#172933]).
+
+[discrete]
+[[bug-fixes-8.15.0]]
+==== Bug fixes
+
+* Fixes a bug that prevented Timeline from properly retrieving results after upgrading to 8.14.1 ({kibana-pull}189031[#189031]).
+* Removes the option to investigate suppressed alerts in Timeline when you're previewing alert details from a rule preview ({kibana-pull}188385[#188385]).
+* Fixes the alignment of the page selector dropdown menu on the Shared Exception Lists page ({kibana-pull}187956[#187956]).
+* Fixes a rule execution error that occured when {esql} rules queried source documents with non-ECS compliant sub-fields under the `event.action` field ({kibana-pull}187549[#187549]).
+* Fixes a bug that caused the `Enable entity risk scoring` option to display even when you didn't have the correct requirements ({kibana-pull}183517[#183517]).
+* Prevents `maxClauseCount` errors from occurring for indicator match rules ({kibana-pull}179748[#179748]).
+* Fixes a bug that prevented threat intelligence fields from correctly rendering in the alert details flyout if they had flattened fields ({kibana-pull}179395[#179395]).