elastic / elastic/integrations

[windows]: Add support for additional Windows Event Channels

Open
#12,831 4 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:windows needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Windows [windows]

### Dataset Name

_No response_

### Integration Version

N/A

### Agent Version

N/A

### OS Version and Architecture

Windows (various versions)

### User Goal

Expand the out-of-the-box support for additional Windows Event channels within the Windows Integration to improve security monitoring and MITRE ATT&CK coverage

### Existing Features

The current Windows Integration doesn't include parsing and normalization for several important Windows Event channels. Users must set up custom integrations to collect these logs.

Priority channels requested:
- TerminalServices channels (3) for RDP lateral movement monitoring
- DNS-Client for DNS monitoring
- TaskScheduler for scheduled task modifications and creations

### What did you see?

![Image](https://github.com/user-attachments/assets/ccef34ab-f157-4056-ba1e-685cf4954665)

### Anything else?

Users need to implement custom monitoring for numerous other security-relevant channels, including:
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Microsoft-Windows-TerminalServices-RDPClient/Operational
- Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
- Microsoft-Windows-DNS-Client/Operational
- Microsoft-Windows-TaskScheduler/Operational

Additional channels requested (partial list):
- Microsoft-Windows-Bits-Client/Operational
- Microsoft-Windows-CAPI2/Operational
- Microsoft-Windows-CodeIntegrity/Operational
- Microsoft-Windows-GroupPolicy/Operational
- Microsoft-Windows-NTLM/Operational
- Microsoft-Windows-Security-Mitigations/KernelMode
- Microsoft-Windows-Security-Mitigations/UserMode
- Microsoft-Windows-WMI-Activity/Operational

This request is supported by recommendations from multiple security organizations including NSA, Palantir, ASD, JPCERT, and aligns with MITRE ATT&CK framework coverage. See ER for details: https://github.com/elastic/enhancements/issues/23899#issue-2854870386

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.