added production memory_protection policy response (#162)

Author: gogochan

custom_schemas/custom_endpoint.yml

@@ -153,6 +153,24 @@
  but not a simple sum of the actions
  short: the overall status of malware
 
+ - name: policy.applied.response.configurations.memory_protection
+ level: custom
+ type: object
+ description: overall memory_protection configuration and status of the applied policy
+
+ - name: policy.applied.response.configurations.memory_protection.concerned_actions
+ level: custom
+ type: keyword
+ description: all actions that were taken for memory_protection
+
+ - name: policy.applied.response.configurations.memory_protection.status
+ level: custom
+ type: keyword
+ description: >
+ the overall status of memory_protection, this is correlated to the status of concerned actions
+ but not a simple sum of the actions
+ short: the overall status of memory_protection
+
  - name: policy.applied.response.configurations.streaming
  level: custom
  type: object

generated/policy/ecs/ecs_flat.yml

@@ -242,6 +242,23 @@
  ignore_above: 1024
  description: the overall status of malware, this is correlated to the status of concerned actions but not a simple sum of the actions
  default_field: false
+ - name: policy.applied.response.configurations.memory_protection
+ level: custom
+ type: object
+ description: overall memory_protection configuration and status of the applied policy
+ default_field: false
+ - name: policy.applied.response.configurations.memory_protection.concerned_actions
+ level: custom
+ type: keyword
+ ignore_above: 1024
+ description: all actions that were taken for memory_protection
+ default_field: false
+ - name: policy.applied.response.configurations.memory_protection.status
+ level: custom
+ type: keyword
+ ignore_above: 1024
+ description: the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions
+ default_field: false
  - name: policy.applied.response.configurations.ransomware.concerned_actions
  level: custom
  type: keyword