Elastic Defend: Adds info about supported Linux file systems

[benironside]

Fixes #5274 by adding information about which Linux file systems Elastic Defend can and cannot monitor.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• [x ] No

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/configure-elastic-defend/configure-linux-file-system-monitoring.md

[nicholasberlin]

Out-of-the-box defaults

With default advanced options, i.e. ignore_unknown_filesystems: true, and both user lists empty, Endpoint does the following:

• Monitors ext2, ext3, ext4, overlay, tmpfs, vfat, btrfs, zfs, xfs
• Ignores all 29 filesystems in the default ignore list
• All other filesystems are ignored as unknown

With default advanced options, except ignore_unknown_filesystems as false:

• Ignores all 29 filesystems in the default ignore list
• All other filesystems are monitored

Advanced option precedence

Here's a break down of Endpoint's decision tree from two perspectives:

1. Endpoint encounters a filesystem not on the default ignore list.
2. Endpoint encounters a filesystem on the default ignore list.

1. Not on default ignore list (by order of precedence):

• in ignored_filesystems -- strongest, always forces ignore
• in monitored_filesystems -- monitored
• in default monitor list -- monitored
• not in any list
  • ignore_unknown_filesystems is true -- ignored
  • ignore_unknown_fileystems is false -- monitored

2. On default ignore list (by order of precedence):

• in monitored_filesystems -- monitored
• otherwise -- ignored

[nicholasberlin]

cannot is in accurate. This is a list of filesystems ignored by default. Since 8.7, this list can be overridden by the advanced option: monitored_filesystems (prior to 8.7, the advanced option did not override).

It is not recommended to override them, especially for network-backed filesystems like nfs. There's already a note on line 100 about this.