[windows_etw] Initial release of Custom Windows ETW integration

[chemamartinez]

Proposed commit message

Add a new input package with a new integration Custom Windows ETW to collect Windows events from the new ETW input.

The minimum Kibana version to run the integration is 8.13.0.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

All changes

• Change follows the contributing guidelines
• Supported versions of the monitoring target are documented
• Supported operating systems are documented (if applicable)
• Integration or System tests exist
• Documentation exists, useful guidelines to follow
• Fields follow ECS and naming conventions
• At least a manual test with ES / Kibana / Agent has been performed.
• Required Kibana version set to: 8.13.0

New Package

• Screenshot of the "Add Integration" page on Fleet added

Dashboards changes

• Not added dashboards as an input package.

Log dataset changes

• Pipeline tests exist (if applicable)
• Generated output for at least 1 log file exists
• Sample event (sample_event.json) exists

Related issues

• Closes Custom ETW input package #8839

Screenshots

Main integration page

Configuration

Elastic Agent policy

Fleet

Discover

Document

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 4e0070f

History

• 💚 Build #10064 succeeded 3b8e6ba
• 💔 Build #9757 failed be1d7ec
• 💔 Build #9742 failed 1ca9a43

cc @chemamartinez

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Please wait for sec-windows-platform approval.

[marc-gr]

lgtm

[elasticmachine]

Package windows_etw - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=windows_etw