From 9964eccb9b257416c91916087a754594fb092933 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon Date: Wed, 30 Sep 2026 19:32:21 -0400 Subject: [PATCH] Add 8.19.23 release notes Co-Authored-By: Claude Sonnet 5 --- docs/release-notes.asciidoc | 1 + docs/release-notes/8.19.asciidoc | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/docs/release-notes.asciidoc b/docs/release-notes.asciidoc index ce1938be64..e9ee26f26c 100644 --- a/docs/release-notes.asciidoc +++ b/docs/release-notes.asciidoc @@ -3,6 +3,7 @@ This section summarizes the changes in each release. +* <> * <> * <> * <> diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index 3758a201ac..1ea6e384a8 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -1,6 +1,32 @@ [[release-notes-header-8.19.0]] == 8.19 +[discrete] +[[release-notes-8.19.23]] +=== 8.19.23 + +[discrete] +[[enhancements-8.19.23]] +==== Enhancements +* Adds an **Update to Elastic version** bulk action to the Rule Updates table that force-upgrades prebuilt rules to the exact Elastic version, discarding any customizations on the updated rules ({kibana-pull}290589[#290589]). + +[discrete] +[[bug-fixes-8.19.23]] +==== Fixes +* Fixes an issue where Attack Discovery didn't automatically select a connector when multiple were available, which disabled **Run** and caused attack discovery generation to fail with a "No model selected" error ({kibana-pull}293656[#293656]). +* Fixes an issue where detection rule failures caused by an invalid IP field query (such as a wildcard or literal value against an `ip` field) were classified as framework errors, which caused them to count against SLO dashboards ({kibana-pull}291256[#291256]). +* Fixes an issue where the Rule details **Alerts** tab could show no results, and throw a `tableById is undefined` error in the console, when the alerts table had not been initialized yet (typical on first visit or in a private window) ({kibana-pull}290076[#290076]). +* Fixes New Terms rule executions failing with `The content length (...) is bigger than the maximum allowed string (...)` when the documents fetched for new terms exceed `elasticsearch.maxResponseSize`. The rule now retries with smaller batches of terms and reports a warning instead of failing ({kibana-pull}290058[#290058]). +* Allows bulk upgrading non-customized prebuilt rules whose rule type changed in the target version (such as `query` to `eql`), instead of blocking the upgrade as a non-solvable conflict ({kibana-pull}288450[#288450]). +* Fixes rule exception items being deleted immediately from the actions menu with no warning. {kib} now shows a confirmation dialog before it deletes the exception item ({kibana-pull}286807[#286807]). +* Fixes high memory usage in {elastic-defend} on Linux when a single process repeatedly calls `exec`. +* Fixes {elastic-defend} retrying Kafka documents that were permanently rejected by the broker due to an invalid topic name. Delivery-report failures now log the topic name alongside the document ID and error code. +* Moves {elastic-defend} diagnostics bundles to its protected data directory instead of shared temporary storage, and removes leftover bundles from previous runs. +* Fixes a bug in {elastic-defend}'s Call Stack Attribution feature that could mis-name DLLs. +* Fixes {elastic-defend} on Linux rejecting Quark and eBPF event sources when only disabled probes were unsupported by the kernel. +* Hardens how {elastic-defend} moves, restores, and stores quarantined files on Linux and macOS. +* Scans the on-disk binaries of already running processes when {elastic-defend} becomes active and MalwareScore is enabled. + [discrete] [[release-notes-8.19.22]] === 8.19.22