# Question about malware sample distribute / sharing

**URL:** <https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465>\
**Category:** Endpoint Security\
**Created:** [May 23, 2025, 9:30am UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465 "2025-05-23T09:30:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mrjh0n1337](https://avatars.discourse-cdn.com/v4/letter/m/9e8a1a/32.png) [@Mrjh0n1337](https://discuss.elastic.co/u/Mrjh0n1337)\
**Post date:** [May 23, 2025, 9:30am UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465/1 "2025-05-23T09:30:33Z")

</div>

I'm a pentester exploring malware dev and want to setup Elastic EDR locally for testing, for the life of me i can't not find anything about detected sample getting share further analysis in Elastic documents.

A friend from work / the red teaming field said there is and i should just turn of the internet for local testing but this will take away some of the capabilities, so my question is does Elastic EDR have a sample sharing thing similar to Microsoft sample submission and if yes how or could i turn it off as a free trial user?

---

<div class="post-metadata">

**Author:** ![Joe\_Desimone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_desimone/32/138779_2.png) [@Joe\_Desimone](https://discuss.elastic.co/u/Joe_Desimone)\
**Post date:** [May 27, 2025, 6:03pm UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465/3 "2025-05-27T18:03:28Z")

</div>

We are working to improve documentation on what is collected by default and the associated configuration options. I believe the applicable option here is [os].advanced.alerts.sample\_collection. You can find it in the "advanced" section of the Elastic Defend policy configuration policy. This can be set to false to disable sample collection.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2025, 6:03pm UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465/4 "2025-06-24T18:03:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.