natasha-moore-elastic · Oct 26, 2026
@@ -1020,6 +1020,12 @@ Advanced settings are not recommended for most users. Use them only if you have
     Use this setting to disable scanning memory for trampolines, even if Memory Threat protection is enabled. Memory Threat protection will remain effective even without this scan.
 
 
+`[linux,mac,windows].advanced.memory_protection.user_yara_rescan_interval_seconds`
+:   Added in 9.6.0.
+
+    *Specify the interval, in seconds, at which memory is re-scanned using custom YARA signatures. Default: `86400`.*
+
+
 `windows.advanced.mitigations.policies.redirection_guard`
 :   Added in 9.3.0.
 

@@ -24,6 +24,7 @@ After the {{agent}} is installed with the {{elastic-defend}} integration, severa
 * Host isolation exceptions
 * Blocked applications 
 * {applies_to}`serverless: ga` {applies_to}`stack: ga 9.4+` {{elastic-endpoint}} exceptions
+* {applies_to}`serverless: ga` {applies_to}`stack: ga 9.6+` Custom YARA signatures
 
 You can also create multiple {{elastic-defend}} integration policies to maintain unique configuration profiles. To create an additional {{elastic-defend}} integration policy, find **Integrations** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then follow the steps for [adding the {{elastic-defend}} integration](/solutions/security/configure-elastic-defend/install-elastic-defend.md#add-security-integration).
 
@@ -78,6 +79,7 @@ To configure an integration policy:
     * [Host isolation exceptions](/solutions/security/manage-elastic-defend/host-isolation-exceptions.md)
     * [Blocklist](/solutions/security/manage-elastic-defend/blocklist.md) 
     * {applies_to}`serverless: ga` {applies_to}`stack: ga 9.4+` [Endpoint exceptions](/solutions/security/manage-elastic-defend/elastic-endpoint-exceptions.md)
+    * {applies_to}`serverless: ga` {applies_to}`stack: ga 9.6+` [Custom YARA signatures](/solutions/security/manage-elastic-defend/custom-yara-signatures.md)
 
    On these tabs, you can:
 
@@ -209,6 +211,8 @@ If you have the appropriate license or project feature tier, you can customize t
 ::::
 
 
+{applies_to}`serverless: ga` {applies_to}`stack: ga 9.6+` Select **Apply custom YARA signatures in detection mode** to have {{elastic-endpoint}} evaluate your [custom YARA signatures](/solutions/security/manage-elastic-defend/custom-yara-signatures.md) against process memory on hosts that use this policy. This setting is available only when memory threat protection is turned on. Custom YARA signatures only detect threats and generate alerts. They never block activity, even when the protection level is **Prevent**.
+
 :::{image} /solutions/images/security-memory-protection.png
 :alt: Detail of memory protection section.
 :screenshot:

@@ -55,6 +55,7 @@ These privileges control access to different parts of endpoint management.
 | **Blocklist** | Access the [Blocklist](/solutions/security/manage-elastic-defend/blocklist.md) page to prevent specified applications from running on hosts, extending the list of processes that {{elastic-defend}} considers malicious. |
 | **Event Filters** | Access the [Event Filters](/solutions/security/manage-elastic-defend/event-filters.md) page to filter out endpoint events that you don’t want stored in {{es}}. |
 | **Endpoint Exceptions** {applies_to}`stack: ga 9.2` {applies_to}`serverless: ga`| Add and use [endpoint exceptions](/solutions/security/manage-elastic-defend/elastic-endpoint-exceptions.md).<br><br>**Note:** In {{stack}} 9.1.0 and earlier, this privilege is included within the **Security** privilege. |
+| **Custom YARA Signatures** {applies_to}`stack: ga 9.6+` {applies_to}`serverless: ga` | Access the [Custom YARA signatures](/solutions/security/manage-elastic-defend/custom-yara-signatures.md) page to add your own YARA rules that {{elastic-defend}} uses to detect threats. |
 | **{{elastic-defend}} Policy Management** | Access the [Policies](/solutions/security/manage-elastic-defend/policies.md) page and {{elastic-defend}} integration policies to configure protections, event collection, and advanced policy features. |
 | **{{elastic-defend}} Scripts Management** {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` | Access the [script library](/solutions/security/endpoint-response-actions/script-library.md) to upload and manage scripts for {{elastic-defend}} `runscript` response actions. |
 :::

@@ -111,6 +111,7 @@ Specific {{kib}} privileges for each artifact type—such as event filters or tr
 * Blocklist items
 * Event filters
 * {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` {{elastic-endpoint}} exceptions (after opting in to per-policy assignment) 
+* {applies_to}`stack: ga 9.6+` {applies_to}`serverless: ga` Custom YARA signatures
 
 The **Global Artifact Management** privilege grants full control over artifacts in any space. This privilege by itself does not enable you to manage the different artifact types, but rather grants additional privileged actions to users who also have the **All** privilege for a given artifact type. This includes the ability to:
 

@@ -27,6 +27,7 @@ After deploying {{elastic-defend}}, you can manage your protected endpoints, tun
 | Reduce false positives from known software | [Trusted applications](/solutions/security/manage-elastic-defend/trusted-applications.md) → [Event filters](/solutions/security/manage-elastic-defend/event-filters.md) |
 | Suppress false positive {{elastic-endpoint}} alerts | [{{elastic-endpoint}} exceptions](/solutions/security/manage-elastic-defend/elastic-endpoint-exceptions.md) |
 | Block known malicious applications | [Blocklist](/solutions/security/manage-elastic-defend/blocklist.md) |
+| {applies_to}`serverless: ga` {applies_to}`stack: ga 9.6+` Detect threats that are specific to your environment | [Custom YARA signatures](/solutions/security/manage-elastic-defend/custom-yara-signatures.md) |
 | Understand different {{elastic-endpoint}} configuration settings | [Optimize {{elastic-defend}}](/solutions/security/manage-elastic-defend/optimize-elastic-defend.md) |
 | Diagnose problems with {{elastic-defend}} | [Automatic troubleshooting](/solutions/security/manage-elastic-defend/automatic-troubleshooting.md) → [Troubleshoot {{elastic-defend}}](/troubleshoot/security/elastic-defend.md) |
 | Prevent users from removing {{agent}}, or remove it from a host | [Prevent {{agent}} uninstallation](/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md) → [Uninstall {{agent}}](/solutions/security/configure-elastic-defend/uninstall-elastic-agent.md) |
@@ -46,7 +47,7 @@ To configure those settings, refer to [Configure an integration policy for {{ela
 
 ## Endpoint artifacts
 
-[Endpoint artifacts](/solutions/security/manage-elastic-defend/endpoint-artifacts.md) let you tailor {{elastic-defend}} behavior to your environment, reducing noise without weakening protection. They include trusted applications, trusted devices, event filters, host isolation exceptions, blocklist entries, and {{elastic-endpoint}} exceptions. Each type changes a different behavior, so compare them in [Optimize {{elastic-defend}}](/solutions/security/manage-elastic-defend/optimize-elastic-defend.md) before you create one.
+[Endpoint artifacts](/solutions/security/manage-elastic-defend/endpoint-artifacts.md) let you tailor {{elastic-defend}} behavior to your environment, reducing noise without weakening protection. Examples include trusted applications, event filters, and blocklist entries. Each type changes a different behavior, so compare them in [Optimize {{elastic-defend}}](/solutions/security/manage-elastic-defend/optimize-elastic-defend.md) before you create one.
 
 ## Protection and security