What's new in 8.8

[jmikell821]

Please add your features/enhancements for 8.8. Don't forget to include the corresponding PR. Thanks!

Rules (done)

Beta Give feedback

1. Maintenance Window: A warning banner displays on the Rules page if a maintenance window is running. During an active maintenance window, rule actions won’t run and alert notifications aren't sent. Document the new Maintenance Windows feature #3253

Cloud Security

Beta Give feedback

1. Container workload protection (BETA): You can now use the Elastic Agent to monitor and protect your containers, and prevent container drift. This solution uses a new integration, Defend for Containers (D4C), which allows you to create custom alerting and enforcement policies. 8.8 D4C integration docs #3247
2. Cloud Native Vulnerability Management (BETA): The new CNVM integration scans your cloud VMs for known vulnerabilities on an ongoing basis. When it finds vulnerabilities, it enables your remediation efforts by providing metadata such as the CVE identifier, CVSS score, severity, affected package, and fix version if available, as well as information about impacted systems. [8.8] Vulnerability management integration docs #3162

Alerts (done)

Beta Give feedback

1. Notification snoozing: Instead of turning rules off to stop alert notifications, you can snooze rule actions for a specified time period. When you snooze rule actions, the rule continues to run on its defined schedule, but won’t perform any actions or send alert notifications. Snoozing alert notifications for detection rules #3217
2. Max alerts warning: When a rule reaches the maximum number of alerts it can generate in a single rule execution, the following warning is displayed on the rule’s details page and in the rule execution log: This rule reached the maximum alert limit for the rule execution. Some alerts were not created. To troubleshoot this event, users are advised to examine their alerts for anything unexpected. Write troubleshooting docs for max alerts warning #3262
3. Alert suppression options for missing suppression fields. Alert suppression options for missing suppression fields #3205
4. Comparison of alert suppression, rule snoozing, exceptions, maintenance windows: Not a new feature, but has descriptions of a few new features that you might be able to reuse? Document comparison of Alert Suppression, Snoozing, Exceptions, Maintenance Windows #3314

Platform (this checklist is done)

Beta Give feedback

1. Features/enhancements

Defend Workflows (done)

Beta Give feedback

1. New response action: execute: Response action: execute #3244

Threat Hunting

Beta Give feedback

1. The Share alert link gives you a one-click way to share a specific alert. Click the link to get a shareable URL that you can paste into browsers, cases, messages, and more. Alerts can be shared via a shareable URL #3184
2. In the Entity Analytics dashboard, you can now filter alerts on the Alerts page by selecting the number link in the column.
3. Inline actions added in more places: Cell actions being added to more places in Security app #3296
4. Visualization actions added to some visualizations: Visualizations & Lens embeddables being added throughout Security app #3298
5. Alerts page drop-down filter controls: Alerts page drop-down filter controls #3256
6. Nested grouping in alerts table: Nested grouping and beta label removed from grouping #3283
7. Delete notes in Timeline: Delete notes in Timeline #3250
8. - [ ] New fields related to the Container Workload Protection promotion rule have been added the highlighted fields section of the alert details flyout. These fields will only show up if they have values in them. (This was only release-noted. You can find a full list of fields at https://github.com/elastic/security-team/issues/6348)

Protections Experience

Beta Give feedback

1. Features/enhancements

ResponseOps

Beta Give feedback

1. Case enhancements: The following changes were introduced for cases in 8.8: Changes to Security cases in 8.8 #3238
2. Users can add files to a case.
3. Users can add the Cases column to the Alerts table to view cases that alerts have been added to. This feature gives users an easy way to identify which cases certain alerts are being investigated in.
4. Case activity and history is paginated and can be sorted.
5. The Alerts tab in cases is GA in 8.8.
6. The privileges for attaching alerts to cases has changed. Now, users need Read access to Security, and All access to Cases.
7. Action summaries and conditional actions: Now, users have more control over how they receive alert notifications. In addition, they can define conditions that must be met for an notification to occur. For example, they might choose to send notifications only if the alert is received between defined hours.

Asset Management

Beta Give feedback

1. No new features in 8.8.

Integrations

Beta Give feedback

1. Add which new integrations have been added