[Security] Fixes Windows quarantine path for Elastic Defend - #7942
[Security] Fixes Windows quarantine path for Elastic Defend#7942natasha-moore-elastic wants to merge 1 commit into
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
🔍 Preview links for changed docs |
| * Windows: | ||
| * Quarantined file: `[DriveLetter:]\.equarantine` on the same volume as the original file (for example, `C:\.equarantine`) | ||
| * Quarantine metadata (`.mdata`) and the quarantine state file: `C:\Program Files\Elastic\Endpoint\state\.equarantine` for files from every volume |
There was a problem hiding this comment.
I'm not so sure. cc @matthewscherer
-
Quarantined file per-volume, yes, agreed 👍 (GetQuarantineDirectoryPath)
-
For
.mdataliving instate\.equarantine\, tho, I don't think that's right. Tracing the write path:- Windows
QuarantineFilewrites metadata withToFile(m_endpointStateDir). m_endpointStateDiris set toGetKeepOnUpgradeDirNoCreate()=ENDPOINT_ROOT\state\(w/ no.equarantine).- FindMdataFilePath joins that base directly with
<GUID>.mdata.
Which makes:
C:\Program Files\Elastic\Endpoint\state\<GUID>.mdata. The only thing instate\.equarantine\is the internal state index then, per CreateStateFileLoadState. - Windows
| * Windows: | |
| * Quarantined file: `[DriveLetter:]\.equarantine` on the same volume as the original file (for example, `C:\.equarantine`) | |
| * Quarantine metadata (`.mdata`) and the quarantine state file: `C:\Program Files\Elastic\Endpoint\state\.equarantine` for files from every volume | |
| * Windows: | |
| * Quarantined file: `[DriveLetter:]\.equarantine` on the same volume as the original file (for example, `C:\.equarantine`) | |
| * Quarantine metadata (`.mdata`): `C:\Program Files\Elastic\Endpoint\state` for files from every volume |
There was a problem hiding this comment.
Good catch, I relied on the info from the Slack thread, but let's see if @matthewscherer can confirm
2 participants
Corrects the Windows quarantine file location for Elastic Defend and removes an outdated version split.
Resolves #7684
Made with Cursor