Elastic integration "Custom Windows Event Logs" package missing

[giomke]

Version

2.4.3

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

32

Storage for /

1000

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi all.
I have 2.4.30 version of security onion.
Do you know why is missing "Custom Windows Event Logs" integration?
And most important, how I can add

Do you have the same issue ?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

These are the current supported integrations - https://docs.securityonion.net/en/2.4/elastic-fleet.html#integrations

[hoalex]

Would it be possible to add this integration in a future release? It would, for example, allow to ingest Windows Defender logs (channel Microsoft-Windows-Windows Defender/Operational)

[InfosecGoon]

Absolutely, we can add it to the list of requested integrations.

[ByteAndBits]

Is there a way to get the custom windows event logs in sec onion? We have some importend tools that log only there.

[OzzyKampha]

Can you also add docker as a integration?