diff --git a/docs/management/admin/trusted-apps.asciidoc b/docs/management/admin/trusted-apps.asciidoc index 9a15767810..0f9ae88b36 100644 --- a/docs/management/admin/trusted-apps.asciidoc +++ b/docs/management/admin/trusted-apps.asciidoc @@ -37,7 +37,7 @@ To add a trusted application: * `Field`: Select a field to identify the trusted application: ** `Hash`: The MD5, SHA-1, or SHA-256 hash value of the application's executable. ** `Path`: The full file path of the application's executable. -** `Signature`: (Windows only) The name of the application's digital signer. +** `Signature`: (Windows and macOS only) The name of the application's digital signer. + TIP: To find the signer's name for an application, go to *Kibana* -> *Discover* and query the process name of the application's executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer's name (for example, `McAfee, Inc.`). diff --git a/docs/serverless/edr-manage/trusted-apps-ov.asciidoc b/docs/serverless/edr-manage/trusted-apps-ov.asciidoc index 3fd5307aff..1fa0438444 100644 --- a/docs/serverless/edr-manage/trusted-apps-ov.asciidoc +++ b/docs/serverless/edr-manage/trusted-apps-ov.asciidoc @@ -43,7 +43,7 @@ To add a trusted application: + *** `Hash`: The MD5, SHA-1, or SHA-256 hash value of the application's executable. *** `Path`: The full file path of the application's executable. -*** `Signature`: (Windows only) The name of the application's digital signer. +*** `Signature`: (Windows and macOS only) The name of the application's digital signer. + [TIP] ====