elastic / elastic/integrations

[meta] Improve windows fleet experience

Open
#13,075 3 comments 1 reaction 0 assignees View on GitHub
Integration:system Integration:windows Integration:winlog Team:Security-Service Integrations UX: needs design
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Problem

Currently in order to consume windows events users need to set up a variety of different integrations and data streams for a complete coverage eg system/security, windows, winlog... This is non obvious and requires previous knowledge of fleet integrations to avoid missing any of them.

In addition to that, common set ups like WEC are not well supported and really convoluted to set up and maintain due to the limitation of a single event channel per integration plus the lack of any way of discovery/listing of system channels from the integration UI.

There are other QoL improvements to make, such as status reporting from the winlog inputs and allowing to reuse assets (pipelines, field definitions, ...) across packages that currently are duplicating them with the maintenance burden it brings.

### Proposed plan

- [Add status reporting for winlog](https://github.com/elastic/beats/pull/43089)
- Implement https://github.com/elastic/package-spec/issues/89 so we can reuse assets between datasets and integrations
- Centralize ingest pipelines and field definitions in `windows` package, reference them from other integrations to avoid duplication.
- Spike to modify winlog integration UI so we can define multiple channels
- This will need to generate various input configurations underneath, equivalent to currently setting multiple integrations up
- Spike to add a mechanism to fetch channels from the host systems and/or, if not possible, enable a WEC mode that subscribe to all forwarded channels
- Spike to centralize configuration of all existing winlog data streams in the `windows` integration (system/security, ...). This should avoid breaking current indices, rules, ...
- Alternatively, if this is not possible, think about a migration strategy to move all into `windows`

#### Resources

- https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/dev_docs/fleet_ui_extensions.md
- https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/public/types/ui_extensions.ts

#### Context:

- https://github.com/elastic/integrations/issues/784
- https://github.com/elastic/integrations/issues/4564
- https://github.com/elastic/integrations/issues/5877
- https://github.com/elastic/integrations/issues/12642

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.