Windows Event Log integration module for Elastic Agent

[dancs85]

Describe the enhancement:
The Elastic Agent should have a module that replicates the functionality of Winlogbeat, including the Powershell, Security and Sysmon modules. If possible, Sysmon itself should be able to be bundled in (if licencing allows) as this will populate a lot of the information the SIEM app uses.

Describe a specific use case for the enhancement or feature:
The Windows event logs are used in both Observability and Security arenas.
Bundling sysmon will cover users who don't opt to use the Elastic Endpoint module (I believe Sysmon/Elastic Endpoint generate very similar logs)

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[ph]

@dancs85 Is under our radar, we want to do some refactor of Winlogbeat/filebeat to add to the elastic agent. But having better windows support is one of our priority.

[ph]

I think we are able to close this, the Elastic Agent now support the window event logs via #19622

@urso WDYT?

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[ph]

Wait, I've misread the ask, the elastic-agent does support the winlog input, we need to have an official integration.

[urso]

The windows package already makes use of the winlog input in Agent. For Sysmon and others we should consider separate integrations. But on the Beats/Agent side itself I think we are done.