[System] Dashboard clean-up for Windows event logs

[andrewkroh]

The windows event log dashboards contained in the system package require some attention to clean them up. They were migrated from Beats and have a few issues as pointed out in #3449.

• Remove duplicate dashboards.
• Fix navigation between dashboards. The navigation visualization can be shared.
• Embed all other non-shared visualizations in the dashboards (aka "by value").
• Replace TSVB visualizations in favor of Lens.
• Check if the same dashboards are contained in the Windows package (for use with Forwarded event logs). Ideally we should only ship the dashboards in one package (like system) and they could still be able to view data from the system, winlog, and windows data streams.
• Ensure that the dashboard aligns with the latest dashboard UX guidelines.

Related

• Migrate system dashboards to by value #3449 (comment)
• Winlogbeat Security new dashboards - Older dashboards improvements beats#18775 (see how the dashboards looked originally)
• User/Group Management Dashboards beats#15236 (the very first instance of the dashboards)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

Also any queries should be created as filters to free up the search bar for users. For example:

BAD:

GOOD:

[efd6]

The Windows integration does not have any dashboards that show the information shown in the System Windows dashboards; it has "[Windows powershell] Overview" and "[Metrics Windows] Services". Winlog has no assets since it's a custom integration.

So marking that item as done.