Deploying npcap with Network Packet Capture integration

[jamiehynds]

Our Network Packet Capture integration (based on Packetbeat) requires a packet sniffing library on most platforms. This is a non-issue on most platforms as you can install libpcap, however Windows requires a library such as npcap, which implements the libpcap interfaces.

NPCAP licensing only allows installation on 5 nodes, after which a license is required. This was often a surprise to our users, who ended up having to pay a significant sum for a license, plus annual maintenance cost. NCPAP also has to be installed independently.

We now have an OEM NPCAP license which allows us to distribute npcap and deploy silently. This ensures our users no longer have to incur additional npcap licensing costs and can easily deploy npcap.

Requirements

1. NPCAP will be be included with both Packetbeat + Network Packet Capture integration.
2. NPCAP will be included in our Basic license.
3. NPCAP will only be installed when the Network Packet Capture integration is enabled, and limited to Windows machines. Installation should be silent (command line arguments here). NPCAP installation should be optional via a setting within the integration - defaulting to true.
4. We currently require WinPcap compatible mode. Is it worth changing to native mode, to avoid having to enable WinPcap mode? Any benefits to native mode?
5. The NCP integration (i.e., for Windows hosts) will need to be governed by a more restrictive license that disallows modification or distribution by the end user, i.e. Elastic License v1.0. These terms should be presented in at least two ways: (1) shown in the integration description and (2) in a LICENSE.TXT (or similar) file accompanying the binary that is downloaded and run.
6. Offline environments - how does a user access the installer and deploy the Network Packet Capture integration in an offline environment?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

@efd6 are we ok to close this one or any loose ends remaining?

[efd6]

I think we can close this.

[jamiehynds]

Closing as all the development effort is now complete to include npcap with both Packetbeat and the Network Packet Capture integration. Targeting 8.1 for release.