elastic / elastic/integrations
system: Standardise naming for System integration security dashboards
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
The managed `system` integration ships several security-focused dashboards (Windows Security, Linux auth, and a Windows overview). Their titles use three different prefix styles and inconsistent casing, which makes them hard to find and group in Kibana.
This issue tracks renaming them to follow the repo convention in [create-dashboards.md](https://github.com/elastic/integrations/blob/main/docs/extend/create-dashboards.md): `[ ] `.
## Background
Windows Security dashboards in particular have no consistent prefix:
- `[Logs System Windows Security] …` (4 dashboards)
- `[System Windows Security] …` (4 dashboards)
- `[System] Windows Overview` (1 dashboard)
Linux auth dashboards already use `[Logs System] …` but with mixed casing.
## Scope
Security-related log dashboards in `packages/system/kibana/dashboard/`:
| Current title | Data stream(s) | Proposed title |
|---|---|---|
| `[System] Windows Overview` | `system.application`, `system.security`, `system.system` | `[Logs System] Windows overview` |
| `[Logs System Windows Security] Directory & Account Monitoring` | `system.security` | `[Logs System] Windows Security Directory & account monitoring` |
| `[Logs System Windows Security] Logon Activity` | `system.security` | `[Logs System] Windows Security Logon activity` |
| `[Logs System Windows Security] Policy & Object Monitoring` | `system.security` | `[Logs System] Windows Security Policy & object monitoring` |
| `[Logs System Windows Security] System & Process Activity` | `system.security` | `[Logs System] Windows Security System & process activity` |
| `[System Windows Security] Failed and Blocked Accounts` | `system.security` | `[Logs System] Windows Security Failed and blocked accounts` |
| `[System Windows Security] Group Management Events` | `system.security` | `[Logs System] Windows Security Group management events` |
| `[System Windows Security] User Logons` | `system.security` | `[Logs System] Windows Security User logons` |
| `[System Windows Security] User Management Events` | `system.security` | `[Logs System] Windows Security User management events` |
| `[Logs System] New users and groups` | `system.auth` | *(no change, or sentence-case only)* |
| `[Logs System] SSH login attempts` | `system.auth` | *(no change)* |
| `[Logs System] Sudo commands` | `system.auth` | *(no change)* |
Metrics dashboards (`[Metrics System] Host overview`, `[Metrics System] Overview`) and `[Logs System] Syslog dashboard` are out of scope.
## Naming rules
1. Bracket prefix is always `[Logs System]` for log dashboards — never `[System …]` or `[Logs System Windows Security]`.
2. Sub-area goes in the name part after the prefix: `Windows Security ` (matches how other multi-data-stream packages name dashboards, e.g. `[Logs AWS] CloudTrail`, `[Logs Azure] Firewall Network Rule Log`).
3. Sentence case for the name part, consistent with existing `[Metrics System] Host overview` and `[Logs System] SSH login attempts`.
4. Title-only change — saved object IDs stay the same, so bookmarks and deep links keep working.
## Open questions
- **Duplicate coverage:** `[System Windows Security] User Logons` and `[Logs System Windows Security] Logon Activity` may overlap. Worth a quick content review before or as part of the rename PR — consolidate if one is redundant.
- **Windows Overview scope:** Covers more than security (`system.application`, `system.system`). Keeping `Windows overview` without a `Security` qualifier seems right; confirm with stakeholders.
- **Dash separator:** Prefer space-only (`Windows Security Logon activity`) over `Windows Security - Logon activity` unless readability testing says otherwise.
## Implementation
- [ ] Update `attributes.title` in the 9 dashboard JSON files under `packages/system/kibana/dashboard/`
- [ ] Add changelog entry (`enhancement`) and bump `system` package version (minor)
- [ ] Run `elastic-package check system`
- [ ] Update dashboard screenshots in package docs if titles are visible
## Ownership
- Windows Security / auth data streams: `@elastic/security-service-integrations`
- Package manifest/changelog: co-owned with `@elastic/obs-infraobs-integrations`
## References
- [Dashboard naming convention](https://github.com/elastic/integrations/blob/main/docs/extend/create-dashboards.md#dashboards)
Contributor guide
Research direction
Read the dashboard naming convention in docs/extend/create-dashboards.md, then inspect the 9 dashboard JSON files under packages/system/kibana/dashboard/ and review the two potentially overlapping Windows security dashboards. Update the titles while preserving saved object IDs, add the enhancement changelog and minor version bump, then run elastic-package check system; completion also includes any needed screenshot updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- observability-sre, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 70/100