The plan is to add AppLocker events into the current Windows integration as additional data streams so that users will not have to use the Custom Windows Integration and have to maintain their own events.

This will help simplify some use cases out there, where AppLocker events are needed. Today, this requires 4 Custom Windows Integrations added to a policy.

The 4 channels that will be added over time are:

AppLocker

• EXE and DLL - [windows] Add Initial AppLocker Data Stream (EXE and DLL) #6977 ; [windows] AppLocker - Add more ECS fields, remove beta flag, add dashboard #7229
• MSI and Script - [windows] Add Windows AppLocker Data Stream (MSI and Script) #7279
• Packaged app-Deployment - [windows] Add Windows AppLocker Data Stream (Packaged app-Deployment) #7393
• Packaged app-Execution - [windows] Add Windows AppLocker Data Stream (Packaged app-Execution) #7446

Field mappings, pipelines and of course dashboards will be in the works.

This issue will track the development of these new data streams.