elastic / elastic/integrations

system: Standardise naming for System integration security dashboards

Open
#21,190 1 comment 0 reactions 0 assignees View on GitHub
dashboard Integration:system Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary

The managed `system` integration ships several security-focused dashboards (Windows Security, Linux auth, and a Windows overview). Their titles use three different prefix styles and inconsistent casing, which makes them hard to find and group in Kibana.

This issue tracks renaming them to follow the repo convention in [create-dashboards.md](https://github.com/elastic/integrations/blob/main/docs/extend/create-dashboards.md): `[ ] `.

## Background

Windows Security dashboards in particular have no consistent prefix:

- `[Logs System Windows Security] …` (4 dashboards)
- `[System Windows Security] …` (4 dashboards)
- `[System] Windows Overview` (1 dashboard)

Linux auth dashboards already use `[Logs System] …` but with mixed casing.

## Scope

Security-related log dashboards in `packages/system/kibana/dashboard/`:

| Current title | Data stream(s) | Proposed title |
|---|---|---|
| `[System] Windows Overview` | `system.application`, `system.security`, `system.system` | `[Logs System] Windows overview` |
| `[Logs System Windows Security] Directory & Account Monitoring` | `system.security` | `[Logs System] Windows Security Directory & account monitoring` |
| `[Logs System Windows Security] Logon Activity` | `system.security` | `[Logs System] Windows Security Logon activity` |
| `[Logs System Windows Security] Policy & Object Monitoring` | `system.security` | `[Logs System] Windows Security Policy & object monitoring` |
| `[Logs System Windows Security] System & Process Activity` | `system.security` | `[Logs System] Windows Security System & process activity` |
| `[System Windows Security] Failed and Blocked Accounts` | `system.security` | `[Logs System] Windows Security Failed and blocked accounts` |
| `[System Windows Security] Group Management Events` | `system.security` | `[Logs System] Windows Security Group management events` |
| `[System Windows Security] User Logons` | `system.security` | `[Logs System] Windows Security User logons` |
| `[System Windows Security] User Management Events` | `system.security` | `[Logs System] Windows Security User management events` |
| `[Logs System] New users and groups` | `system.auth` | *(no change, or sentence-case only)* |
| `[Logs System] SSH login attempts` | `system.auth` | *(no change)* |
| `[Logs System] Sudo commands` | `system.auth` | *(no change)* |

Metrics dashboards (`[Metrics System] Host overview`, `[Metrics System] Overview`) and `[Logs System] Syslog dashboard` are out of scope.

## Naming rules

1. Bracket prefix is always `[Logs System]` for log dashboards — never `[System …]` or `[Logs System Windows Security]`.
2. Sub-area goes in the name part after the prefix: `Windows Security ` (matches how other multi-data-stream packages name dashboards, e.g. `[Logs AWS] CloudTrail`, `[Logs Azure] Firewall Network Rule Log`).
3. Sentence case for the name part, consistent with existing `[Metrics System] Host overview` and `[Logs System] SSH login attempts`.
4. Title-only change — saved object IDs stay the same, so bookmarks and deep links keep working.

## Open questions

- **Duplicate coverage:** `[System Windows Security] User Logons` and `[Logs System Windows Security] Logon Activity` may overlap. Worth a quick content review before or as part of the rename PR — consolidate if one is redundant.
- **Windows Overview scope:** Covers more than security (`system.application`, `system.system`). Keeping `Windows overview` without a `Security` qualifier seems right; confirm with stakeholders.
- **Dash separator:** Prefer space-only (`Windows Security Logon activity`) over `Windows Security - Logon activity` unless readability testing says otherwise.

## Implementation

- [ ] Update `attributes.title` in the 9 dashboard JSON files under `packages/system/kibana/dashboard/`
- [ ] Add changelog entry (`enhancement`) and bump `system` package version (minor)
- [ ] Run `elastic-package check system`
- [ ] Update dashboard screenshots in package docs if titles are visible

## Ownership

- Windows Security / auth data streams: `@elastic/security-service-integrations`
- Package manifest/changelog: co-owned with `@elastic/obs-infraobs-integrations`

## References

- [Dashboard naming convention](https://github.com/elastic/integrations/blob/main/docs/extend/create-dashboards.md#dashboards)

Contributor guide

Open the contributing guide

Research direction

Read the dashboard naming convention in docs/extend/create-dashboards.md, then inspect the 9 dashboard JSON files under packages/system/kibana/dashboard/ and review the two potentially overlapping Windows security dashboards. Update the titles while preserving saved object IDs, add the enhancement changelog and minor version bump, then run elastic-package check system; completion also includes any needed screenshot updates.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
observability-sre, security
Issue type
Refactor
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.