[windows] Mark sensitive values as secret

[taylor-swanson]

There are two configuration values flagged in #8610 that need to be marked as secret:

• httpjson.password
• httpjson.token

In order to support secrets variables and validation, the package-spec version of the integration will need to be raised to 3.0.2 or higher. As a note, migrating to package-spec 3.0 or higher will more than likely trigger validation errors for fields. One of the main reasons why windows is being held back at pkg-spec 1.0.0 is due to the presence of dynamic metrics fields in the perfmon data stream. This is no longer allowed in newer versions of pkg-spec.

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[jlind23]

@cmacknz @pierrehilbert any reason why the data plane team is mentioned as the codeowner here https://github.com/elastic/integrations/blob/ca7078d194b387d0d390e996a09dcddedc84b491/.github/CODEOWNERS#L352C1-L353C1 ?

[pierrehilbert]

We discussed with @nfritts a month ago and his team should be the owner.

[jlind23]

@pierrehilbert let's make sure we have a pr for this then. @nfritts what's the right github team we should use then?

[nimarezainia]

Should we remove the data plane team from that ownership file. I think majority of the inputs are security owned.

[pierrehilbert]

Yes we should, we are waiting to have a confirmation from @nfritts about the team we should add instead of the Data Plane team to open a PR.

[marc-gr]

Even though the upgrade to a most recent package-spec is something we should do, I wonder if we want to keep the httpjson based Splunk input. @jamiehynds what do you think? Would be something we could remove, also from the other couple integrations that have it?