[Security] 9.2.1 release notes

release-notes/elastic-cloud-serverless/known-issues.md

@@ -16,6 +16,22 @@ Known issues are significant defects or limitations that may impact your impleme
 
 ## Active
 
+
+
+::::{dropdown} Alerts aren't generated for rules with alert flapping off and an alert delay higher than 1
+
+**Details**
+
+On October 22, 2025, it was discovered that alerts aren't generated for rules that have **Alert flapping detection** turned off and the alert delay set to a value higher than 1.
+
+**Workaround**
+
+Set the alert delay value to 1 or turn on **Alert flapping detection**.
+
+::::
+
+## Resolved
+
 :::{dropdown} Entity store transform is unavailable 
 
 **Details**
@@ -29,22 +45,12 @@ Restart the entity store:
 2. On the **Entity Store** page, turn the toggle off.
 3. Turn the toggle back on.
 
-::::
-
-::::{dropdown} Alerts aren't generated for rules with alert flapping off and an alert delay higher than 1
-
-**Details**
-
-On October 22, 2025, it was discovered that alerts aren't generated for rules that have **Alert flapping detection** turned off and the alert delay set to a value higher than 1.
+**Resolved** 
 
-**Workaround**
-
-Set the alert delay value to 1 or turn on **Alert flapping detection**.
+This was resolved on November 4, 2025.
 
 ::::
 
-## Resolved
-
 :::{dropdown} CSPM and Asset Management integrations don't ingest data when deployed using agent-based technology if {{kib}} is hosted on AWS
 Applies to: {{serverless-short}} deployments hosted on AWS
 

release-notes/elastic-security/index.md

@@ -27,6 +27,22 @@ To check for security updates, go to [Security announcements for the Elastic sta
 
 % *
 
+## 9.2.1 [elastic-security-9.2.1-release-notes]
+
+### Features and enhancements [elastic-security-9.2.1-features-enhancements]
+
+* Improves the startup log in {{elastic-defend}} to explain the details of unsigned policy.
+* Improves the accuracy of thread CPU usage reported in {{elastic-defend}} metrics documents.
+
+### Fixes [elastic-security-9.2.1-fixes]
+* Fixes an issue where switching from agentless to agent-based cloud posture caused CSPM and Asset Inventory data to stop ingesting [#241390]({{kib-pull}}241390).
+* Fixes a react-query key collision that occurred when two different integration lookups shared the same key, which could cause errors when navigating between pages [#240517]({{kib-pull}}240517).
+* Fixes an {{elastic-defend}} bug in Linux event collection where some long-running processes were not enriched.
+* Fixes multiple {{elastic-defend}} issues in malware protection for Linux where a deadlock could sometimes occur when containers and autofs were both active.
+* Fixes an issue in {{elastic-defend}} that could cause the `get-file` and `execute` response actions to start failing after many are issued with a single running instance of {{elastic-defend}}
+* Improves {{elastic-defend}} detection of file rename operations on Windows when performed over Server Message Block (SMB).
+* Fixes an {{elastic-defend}} issue on Windows where the `code_signature.thumbprint_sha256` field was missing under process and DLL events for certain event types.
+
 
 ## 9.2.0 [elastic-security-9.2.0-release-notes]
 

release-notes/elastic-security/known-issues.md

@@ -31,6 +31,10 @@ Restart the entity store:
 2. On the **Entity Store** page, turn the toggle off.
 3. Turn the toggle back on.
 
+**Resolved**<br>
+
+Resolved in {{stack}} 9.2.1
+
 ::::
 
 :::{dropdown} CSPM and Asset Management integrations don't ingest data when deployed using agent-based technology if {{kib}} is hosted on AWS