elastic / elastic/integrations
[meta] Improve windows fleet experience
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Problem
Currently in order to consume windows events users need to set up a variety of different integrations and data streams for a complete coverage eg system/security, windows, winlog... This is non obvious and requires previous knowledge of fleet integrations to avoid missing any of them.
In addition to that, common set ups like WEC are not well supported and really convoluted to set up and maintain due to the limitation of a single event channel per integration plus the lack of any way of discovery/listing of system channels from the integration UI.
There are other QoL improvements to make, such as status reporting from the winlog inputs and allowing to reuse assets (pipelines, field definitions, ...) across packages that currently are duplicating them with the maintenance burden it brings.
### Proposed plan
- [Add status reporting for winlog](https://github.com/elastic/beats/pull/43089)
- Implement https://github.com/elastic/package-spec/issues/89 so we can reuse assets between datasets and integrations
- Centralize ingest pipelines and field definitions in `windows` package, reference them from other integrations to avoid duplication.
- Spike to modify winlog integration UI so we can define multiple channels
- This will need to generate various input configurations underneath, equivalent to currently setting multiple integrations up
- Spike to add a mechanism to fetch channels from the host systems and/or, if not possible, enable a WEC mode that subscribe to all forwarded channels
- Spike to centralize configuration of all existing winlog data streams in the `windows` integration (system/security, ...). This should avoid breaking current indices, rules, ...
- Alternatively, if this is not possible, think about a migration strategy to move all into `windows`
#### Resources
- https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/dev_docs/fleet_ui_extensions.md
- https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/public/types/ui_extensions.ts
#### Context:
- https://github.com/elastic/integrations/issues/784
- https://github.com/elastic/integrations/issues/4564
- https://github.com/elastic/integrations/issues/5877
- https://github.com/elastic/integrations/issues/12642
Contributor guide
Assessment
This issue has not been assessed yet.