8.12 Release Notes

docs/release-notes.asciidoc

@@ -3,6 +3,7 @@
 
 This section summarizes the changes in each release.
 
+* <<release-notes-8.12.0, {elastic-sec} version 8.12.0>>
 * <<release-notes-8.11.3, {elastic-sec} version 8.11.3>>
 * <<release-notes-8.11.2, {elastic-sec} version 8.11.2>>
 * <<release-notes-8.11.1, {elastic-sec} version 8.11.1>>
@@ -52,6 +53,7 @@ This section summarizes the changes in each release.
 :issue: https://github.com/elastic/kibana/issues/
 :pull: https://github.com/elastic/kibana/pull/
 
+include::release-notes/8.12.asciidoc[]
 include::release-notes/8.11.asciidoc[]
 include::release-notes/8.10.asciidoc[]
 include::release-notes/8.9.asciidoc[]

docs/release-notes/8.12.asciidoc

@@ -0,0 +1,74 @@
+[[release-notes-header-8.12.0]]
+== 8.12
+
+[discrete]
+[[release-notes-8.12.0]]
+=== 8.12.0
+
+[discrete]
+[[known-issue-8.12.0]]
+==== Known issues
+
+There are no known issues in 8.12.0.
+
+[discrete]
+[[breaking-changes-8.12.0]]
+==== Breaking changes
+
+There are no breaking changes in 8.12.0.
+
+[discrete]
+[[deprecations-8.12.0]]
+==== Deprecations
+
+There are no deprecations in 8.12.0.
+
+[discrete]
+[[features-8.12.0]]
+==== New features
+
+* Introduces the ability to assign alerts to specific users ({pull}170579[#170579]), ({pull}171589[#171589]).
+* Introduces Retrieval Augmented Generation (RAG) for Alerts, allowing you to give Elastic AI Assistant context about more alerts in your environment ({pull}172542[#172542]).
+* Enables alert suppression for threshold rules ({pull}171423[#171423]).
+* Adds an *Updates* tab to the prebuilt rules upgrade flyout to show differences between the installed and updated versions ({pull}172535[#172535]).
+* Adds a setting that lets you exclude cold and frozen tiers from visual event analyzer queries ({pull}172162[#172162]).
+* Adds a tour to guide users through Timelines UI changes ({pull}172030[#172030]).
+* Adds a timeout option for Osquery queries, so you can customize the maximum time each query should run before timing out ({pull}169925[#169925]).
+* Introduces new grouping capabilities for CSPM and KSPM Findings data ({pull}169884[#169884]).
+* Adds the expandable alert details flyout to the rule preview panel ({pull}167902[#167902]).
+* Adds a button to rule execution error messages that lets you ask AI Assistant to diagnose errors ({pull}166778[#166778]).
+
+[discrete]
+[[enhancements-8.12.0]]
+==== Enhancements
+
+* Refactors the timeline UI — various minor updates ({pull}168230[#168230]).
+* Introduces manual saving for Timeline ({pull}171027[#171027], {pull}169239[#169239]).
+* Improves forward-compatibility for the rule schema ({pull}170861[#170861]).
+* Simplifies the format of risk engine API error responses ({pull}170645[#170645]).
+* Makes various UI improvements to the alert details flyout ({pull}170279[#170279], {pull}169035[#169035], {pull}173399[#173399], {pull}170078[#170078], {pull}168297[#168297]).
+* Saves the state of the alert details flyout in the browser. For example, after you use the flyout's *Investigate in timeline* button, you can click your browser's back button to return to the flyout ({pull}169661[#169661]).
+* Integrates a new Event Tracing for Windows (ETW) provider (Microsoft-Windows-Win32k) to create new event types that can be used by prebuilt endpoint rules to detect keylogging activity.
+* Allows for acting and target memory region buffers within behavior alerts to be scanned against {elastic-sec}'s collection of YARA signatures when collected. Detections are added to alerts.
+* Adds a new ReadProcessMemory (lsass) event that can be used by prebuilt endpoint rules to detect credential dumping.
+* Adds a link to the Edit connector UI for Amazon Bedrock that goes to the token tracking dashboard ({pull}172115[#172115]).
+* Allows you to use the `matches` operator when defining Endpoint rule exceptions and trusted applications.
+
+[discrete]
+[[bug-fixes-8.12.0]]
+==== Bug fixes
+
+* Fixes response action bugs by mapping the `unisolate` command to the `release` command and the `running-processes` command to the `processes` command ({pull}173831[#173831]).
+* Fixes the dark theme for the alert details flyout footer ({pull}173577[#173577]).
+* Makes the Timeline tour compatible with the Timeline template page ({pull}173526[#173526]).
+* Stops the {esql} tab from rendering when Timeline isn't open ({pull}173484[#173484]).
+* Fixes a bug that caused {ml} fetch jobs to fail when the default data view (`securitySolution:defaultIndex`) contained special characters ({pull}173426[#173426]).
+* Remove the **Assignees** field from the event details flyout ({pull}173314[#173314]).
+* Fixes a bug that caused the **Add to Case** action to fail if you didn't add a comment before isolating and releasing a host ({pull}172912[#172912]).
+* Fixes a UI bug that overlaid **Default Risk score** values as you created a new rule ({pull}172677[#172677]).
+* Fixes a bug that cleared configured fields in the exceptions flyout after the flyout reloaded and refocused ({pull}172666[#172666]).
+* Limits the character length for exception comments to 3000 characters, and makes the error message more descriptive if the limit's exceeded ({pull}170764[#170764]).
+* Adds missing alerts index filtration from sourcerer that was removed during refactoring ({pull}170484[#170484]).
+* Fixes a bug that didn't allow exceptions to be created or edited after an error displayed ({pull}169801[#169801]).
+* Stops {security-app} pages from crashing when there's a fields error in the **Stack by** component ({pull}168411[#168411]).
+* Adds a feature flag (`timelineEsqlTabDisabled`) for the **{esql}** tab in Timeline ({pull}174029[#174029]).