[BugFix] Windows/System: Populate Scheduled Task Enabled When Omitted

[w0rk3r]

Proposed commit message

windows,system: populate winlog.scheduled_task.settings.enabled with true when Settings/Enabled is omitted

Task Scheduler defaults Settings/Enabled to true when the element is
omitted. The current pipelines only populate
winlog.scheduled_task.settings.enabled when the value is explicitly
set, so real scheduled task events can leave the effective state
unknown even though Windows treats the task as enabled.

Summary

Follow-up to #19193.

Task Scheduler defaults Settings/Enabled to true when the element is omitted. The current pipelines only populate winlog.scheduled_task.settings.enabled when the value is explicit, so real scheduled task events can leave the effective state unknown even though Windows treats the task as enabled.

This PR:

• Populates winlog.scheduled_task.settings.enabled: true when Settings exists and Enabled is omitted.
• Keeps explicit true and false values unchanged.
• Leaves the field absent when Settings is absent or Enabled is invalid.
• Updates the field documentation and existing real-event expectations in the System security and Windows forwarded data streams.

The existing captured 4698 and 4700 fixtures omit Settings/Enabled and now assert the effective value. Their raw TaskContent remains unchanged.

Validation

• System and Windows package build and lint.
• System security and Windows forwarded pipeline suites.
• Matching scheduled-task pipelines across both packages.
• Existing captured 4698 and 4700 events with omitted Settings/Enabled.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[Copilot]

Pull request overview

This PR fixes scheduled task normalization in the Windows forwarded and System security pipelines by treating an omitted Settings/Enabled element as effectively enabled (true), matching Task Scheduler defaults, and updates docs/tests accordingly.

Changes:

• Default winlog.scheduled_task.settings.enabled to true when Settings exists but Enabled is omitted (while preserving explicit values and ignoring invalid ones).
• Update field documentation to describe effective enabled semantics and omission/invalid handling.
• Update existing pipeline test expectations and bump package versions + changelogs.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/windows/manifest.yml	Bumps Windows package version to 3.9.3.
packages/windows/data_stream/forwarded/fields/winlog.yml	Updates field description for effective enabled semantics.
packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/security_scheduled_task.yml	Implements Settings/Enabled defaulting behavior when omitted.
packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4700-scheduled-task-trigger-defaults.json-expected.json	Updates expected output to include settings.enabled: true.
packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4700-scheduled-task-enabled.json-expected.json	Updates expected output to include settings.enabled: true.
packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4698-scheduled-task-trigger-boolean-lexical.json-expected.json	Updates expected output to include settings.enabled: true.
packages/windows/changelog.yml	Adds 3.9.3 changelog entry for the bugfix.
packages/system/manifest.yml	Bumps System package version to 2.23.3.
packages/system/docs/README.md	Updates the exported field documentation row for settings.enabled.
packages/system/data_stream/security/fields/winlog.yml	Updates field description for effective enabled semantics.
packages/system/data_stream/security/elasticsearch/ingest_pipeline/scheduled_task.yml	Implements Settings/Enabled defaulting behavior when omitted.
packages/system/data_stream/security/_dev/test/pipeline/test-4700-scheduled-task-trigger-defaults.json-expected.json	Updates expected output to include settings.enabled: true.
packages/system/data_stream/security/_dev/test/pipeline/test-4700-scheduled-task-enabled.json-expected.json	Updates expected output to include settings.enabled: true.
packages/system/data_stream/security/_dev/test/pipeline/test-4698-scheduled-task-trigger-boolean-lexical.json-expected.json	Updates expected output to include settings.enabled: true.
packages/system/changelog.yml	Adds 2.23.3 changelog entry for the bugfix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

/test

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 121ed53

History

• 💔 Build #48756 failed ab35f0a

cc @w0rk3r

[belimawr]

Approving the changes in the files that belong to the data-plane team.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package system - 2.23.3 containing this change is available at https://epr.elastic.co/package/system/2.23.3/

[elastic-vault-github-plugin-prod]

Package windows - 3.9.3 containing this change is available at https://epr.elastic.co/package/windows/3.9.3/