elastic / elastic/integrations
[windows]: Add support for additional Windows Event Channels
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Windows [windows]
### Dataset Name
_No response_
### Integration Version
N/A
### Agent Version
N/A
### OS Version and Architecture
Windows (various versions)
### User Goal
Expand the out-of-the-box support for additional Windows Event channels within the Windows Integration to improve security monitoring and MITRE ATT&CK coverage
### Existing Features
The current Windows Integration doesn't include parsing and normalization for several important Windows Event channels. Users must set up custom integrations to collect these logs.
Priority channels requested:
- TerminalServices channels (3) for RDP lateral movement monitoring
- DNS-Client for DNS monitoring
- TaskScheduler for scheduled task modifications and creations
### What did you see?

### Anything else?
Users need to implement custom monitoring for numerous other security-relevant channels, including:
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Microsoft-Windows-TerminalServices-RDPClient/Operational
- Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
- Microsoft-Windows-DNS-Client/Operational
- Microsoft-Windows-TaskScheduler/Operational
Additional channels requested (partial list):
- Microsoft-Windows-Bits-Client/Operational
- Microsoft-Windows-CAPI2/Operational
- Microsoft-Windows-CodeIntegrity/Operational
- Microsoft-Windows-GroupPolicy/Operational
- Microsoft-Windows-NTLM/Operational
- Microsoft-Windows-Security-Mitigations/KernelMode
- Microsoft-Windows-Security-Mitigations/UserMode
- Microsoft-Windows-WMI-Activity/Operational
This request is supported by recommendations from multiple security organizations including NSA, Palantir, ASD, JPCERT, and aligns with MITRE ATT&CK framework coverage. See ER for details: https://github.com/elastic/enhancements/issues/23899#issue-2854870386
Contributor guide
Assessment
This issue has not been assessed yet.