elastic / elastic/integrations
Windows Custom Event Logs - add support for multiple channels
Open
enhancement
Integration:winlog
Team:Security-Windows Platform
UX: needs design
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
Currently the windows custom event integration only allows adding a single event channel. Add support for multiple event channels.
I noticed I can add multiple packages using the fleet api but kibana only shows the first package - so this may only require a minimal change in kibana to handle the package_policy array.
There are a few other feature requests which mention this as part of a larger enhancement.
https://github.com/elastic/integrations/issues/4564
https://github.com/elastic/integrations/issues/784
[🎨Figma design file](https://www.figma.com/design/rfDhkz1p0MoGBManv7udAg/Improve-windows-fleet-experience?node-id=277-32&t=LxB9qgJEfzIylS0F-1)
Contributor guide
Assessment
This issue has not been assessed yet.