💚 CLA has been signed

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

/test

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

@andrewkroh :
This could potentially broaden the range of configurations for Winlog, given that it accepts any configuration in YAML format. Hence, increasing the likelihood of integration breakages.
Would it be better to give a specific yaml box for the requirement like we do for say SSL.

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

@andrewkroh : Please see if we would like to proceed with this change. I had one concern as mentioned here.

Hence, increasing the likelihood of integration breakages. Would it be better to give a specific yaml box for the requirement like we do for say SSL.

This is true given that there is no validation of the YAML. But I don't think scoping the YAML to one setting (like ssl: {{ssl}}) is any better because no matter where the invalid YAML is placed it will break the configuration. It's the same problem that exists for processors. So I don't think this drastically increases the risk of invalid configurations.

I would like to see us build a UI component that encapsulates all of the winlog input settings. It would encode all of the validation rules like mutual exclusivity between options, provide type-ahead for the most common channel names, and do validiton of the processors YAML based on json-schema. This would be a better UX and reduce this risk of saving an invalid config.

/test

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

💚 Build Succeeded

• Buildkite Build
• Commit: 599c83b

History

• 💚 Build #10099 succeeded 5d33cbc

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

Package system - 1.56.0 containing this change is available at https://epr.elastic.co/search?package=system