Winlogbeat Security new dashboards - Older dashboards improvements

[janniten]

What does this PR do?

This PR adds two new dashboards related to events added in PRs (#12906, #14299, #15217, #17517) and implements some improvements to existing winlogbeat security module's dashboard

New Dashboards

• User Logon Dashboard shows all the logon information. It allow us to keep track between logon and admin logons event between RDP connections and disconnections.
• Failed and Blocked Accounts allow us to keep track to failed logons and locked out account

Existing Dashboards

• Added Distribution groups Events (Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping #15217)
• Found that Event 4625 can be generated by two different providers: Microsoft-Windows-Security-Auditing and Microsoft-Windows-EventSystem. Filters to use only the event.code=4625 from Microsoft-Windows-Security-Auditing where added

All Dashboards

• Markdown with links all the winlogbeat security dashboards where added (following the idea of Filebeats, Auditbeat dashboards)
  

• Visualization that use may events (like group management related visualizations)
  were modified in order to use a saved search with the relevant events for that visualization as a source (instead of using individual filters for each visualization)

• Removed the margin between panels to look in the same way that other beats dashboards

• TSVB metrics were modified to use the Entire Time Range and to use eye-friendlier colors

Why is it important?

These dashboards allows to take profit of the events processed by the winlogbeat security.
All of them were created for real life companies (a telco company and a hospital) and are heavily used in the day-by-day security operation.

Checklist

• My code follows the style guidelines of this project
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Screenshots

Failed and Blocked Accounts

User Logons

Group Managment

User Management

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [andrewkroh commented: jenkins, run tests]

• Start Time: 2020-06-04T21:06:15.374+0000

• Duration: 38 min 24 sec

Test stats 🧪

Test	Results
Failed	0
Passed	598
Skipped	127
Total	725

[andrewkroh]

jenkins, run tests please

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

jenkins, run tests

[andrewkroh]

jenkins, run tests

[andrewkroh]

These look great. Thank you!

I'll probably adopt that header format across all of the dashboards.

[janniten]

While testing some issues with index patterns and winlogbeat dashboards I've realize that this dashboards are not in winlogbeat 7.9.x.
The older version is installed instead (#15236).
The new version fixes some issues and adds functionality.
Is there any reason why this dashboards (#18775) are not used? @andrewkroh Should I modify something?
Thank you