*"Elastic Defend scan response action should include scan statistics in the response payload: files scanned count, threats detected count, and scan duration breakdown." in Kibana
*
Reference the field path where it should appear:
EndpointActions.data.output.content.files_scanned
EndpointActions.data.output.content.threats_found
Reason: We need to collect evidence as how many files were scanned by Elastic defend.
how many threats detected per host.
How much time it took to complete the OnDemand scan.
*"Elastic Defend scan response action should include scan statistics in the response payload: files scanned count, threats detected count, and scan duration breakdown." in Kibana
*
Reference the field path where it should appear:
EndpointActions.data.output.content.files_scanned
EndpointActions.data.output.content.threats_found
Reason: We need to collect evidence as how many files were scanned by Elastic defend.
how many threats detected per host.
How much time it took to complete the OnDemand scan.