diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index d1f0143dbe00..147ca45ced16 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -7,6 +7,7 @@ env:
   IMAGE_WIN_2019: "family/core-windows-2019"
   IMAGE_WIN_2022: "family/core-windows-2022"
   IMAGE_RHEL9: "family/core-rhel-9"
+  IMAGE_MACOS_X86_64: "generic-13-ventura-x64"
 
 steps:
   - group: "Auditbeat Mandatory Testing"
@@ -74,7 +75,7 @@ steps:
 
   - group: "Extended Testing"
     key: "extended-tests"
-    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for extended support"
 
     steps:
       - label: ":linux: ARM64 Unit Tests"
@@ -101,7 +102,7 @@ steps:
               context: "auditbeat/Extended: MacOS Unit Tests"
         agents:
           provider: "orka"
-          imagePrefix: "generic-13-ventura-x64"
+          imagePrefix: "${IMAGE_MACOS_X86_64}"
         artifact_paths: "auditbeat/build/*.xml"
 
   - group: "Windows Extended Testing"
@@ -130,39 +131,7 @@ steps:
     if: build.env("BUILDKITE_PULL_REQUEST") != "false"
     depends_on:
       - "mandatory-tests"
-      - "extended-tests"
-      - "extended-tests-win"
 
     steps:
       - label: Package pipeline
         commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
-
-      - label: ":ubuntu: Packaging Linux X86"
-        key: "package-linux-x86"
-        env:
-          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
-        command:
-          - ".buildkite/auditbeat/scripts/package.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Packaging: Linux X86"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_UBUNTU_X86_64}"
-
-      - label: ":linux: Packaging Linux ARM"
-        key: "package-linux-arm"
-        env:
-          PLATFORMS: "linux/arm64"
-          PACKAGES: "docker"
-        command:
-          - ".buildkite/auditbeat/scripts/package.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Packaging: Linux ARM"
-        agents:
-          provider: "aws"
-          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
-          instanceType: "t4g.large"
-        artifact_paths:
-          - "auditbeat/build/distributions/*.tar.gz"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
index 7affd50f694b..866d6be42239 100755
--- a/.buildkite/auditbeat/scripts/crosscompile.sh
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -4,5 +4,5 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Executing Crosscompile ::"
+echo "--- Executing Crosscompile"
 make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
index 8b348bafa713..4d9167c74f84 100755
--- a/.buildkite/auditbeat/scripts/package-step.sh
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -23,7 +23,7 @@ if are_files_changed "$changeset"; then
           - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "Auditbeat/Packaging: Linux X86"
+              context: "auditbeat/Packaging: Linux X86"
         agents:
           provider: "gcp"
           image: "${IMAGE_UBUNTU_X86_64}"
@@ -37,7 +37,7 @@ if are_files_changed "$changeset"; then
           - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "Auditbeat/Packaging: ARM"
+              context: "auditbeat/Packaging: ARM"
         agents:
           provider: "aws"
           imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
index 58d86bfb8b42..71872ca15a35 100755
--- a/.buildkite/auditbeat/scripts/package.sh
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -4,10 +4,9 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Docker Version ::"
-docker --version
+echo "--- Docker Version: $(docker --version)"
 
-echo ":: Start Packaging ::"
+echo "--- Start Packaging"
 cd auditbeat
 umask 0022
 mage package
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
index 9065d5b57363..c1f5685c77fe 100755
--- a/.buildkite/auditbeat/scripts/unit-tests.sh
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Running Unit Tests ::"
+echo "--- Running Unit Tests"
 sudo chmod -R go-w auditbeat/
 
 cd auditbeat
diff --git a/.buildkite/env-scripts/linux-env.sh b/.buildkite/env-scripts/linux-env.sh
index d3340dd45634..5e6e5f7cbf05 100644
--- a/.buildkite/env-scripts/linux-env.sh
+++ b/.buildkite/env-scripts/linux-env.sh
@@ -9,14 +9,14 @@ DEBIAN_FRONTEND="noninteractive"
 sudo mkdir -p /etc/needrestart
 echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
 
-echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
+echo "--- PLATFORM TYPE $PLATFORM_TYPE"
 
 if [[ $PLATFORM_TYPE == "Linux" ]]; then
   # Remove this code once beats specific agent is set up
   if grep -q 'Ubuntu' /etc/*release; then
     export DEBIAN_FRONTEND
 
-    echo ":: Ubuntu - Installing libs ::"
+    echo "--- Ubuntu - Installing libs"
     sudo apt-get update
     sudo apt-get install -y libsystemd-dev
     sudo apt install -y python3-pip
@@ -25,7 +25,7 @@ if [[ $PLATFORM_TYPE == "Linux" ]]; then
 
   # Remove this code once beats specific agent is set up
   if grep -q 'Red Hat' /etc/*release; then
-    echo ":: RHL - Installing libs ::"
+    echo "--- RHL - Installing libs"
     sudo yum update -y
     sudo yum install -y systemd-devel
     sudo yum install -y python3-pip
@@ -35,13 +35,13 @@ if [[ $PLATFORM_TYPE == "Linux" ]]; then
 fi
 
 if [[ $PLATFORM_TYPE == Darwin* ]]; then
-  echo ":: Setting larger ulimit on MacOS ::"
+  echo "--- Setting larger ulimit on MacOS"
   # To bypass file descriptor errors like "Too many open files error" on MacOS
   ulimit -Sn 50000
-  echo ":: ULIMIT :: $(ulimit -n)"
+  echo "--- ULIMIT: $(ulimit -n)"
 fi
 
-echo ":: Setting up environment ::"
+echo "--- Setting up environment"
 add_bin_path
 with_go
 with_mage
diff --git a/.buildkite/env-scripts/win-env.sh b/.buildkite/env-scripts/win-env.sh
index aa5f67ca4cee..dbedb29f516f 100644
--- a/.buildkite/env-scripts/win-env.sh
+++ b/.buildkite/env-scripts/win-env.sh
@@ -1,8 +1,12 @@
 #!/usr/bin/env bash
 
 install_python_win() {
+  echo "PLATFORM TYPE: ${PLATFORM_TYPE}"
   if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
+    echo "Installing Python on Win"
     choco install mingw -y
     choco install python --version=3.11.0 -y
   fi
 }
+
+install_python_win
diff --git a/.buildkite/filebeat/scripts/integration-gotests.sh b/.buildkite/filebeat/scripts/integration-gotests.sh
index a3eabf70c0d3..d64ce7c98eb2 100755
--- a/.buildkite/filebeat/scripts/integration-gotests.sh
+++ b/.buildkite/filebeat/scripts/integration-gotests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Integration Tests ::"
+echo "--- Executing Integration Tests"
 sudo chmod -R go-w filebeat/
 
 cd filebeat
diff --git a/.buildkite/filebeat/scripts/integration-pytests.sh b/.buildkite/filebeat/scripts/integration-pytests.sh
index 5e2e403dda87..b51e8ae18a68 100755
--- a/.buildkite/filebeat/scripts/integration-pytests.sh
+++ b/.buildkite/filebeat/scripts/integration-pytests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Integration Tests ::"
+echo "--- Executing Integration Tests"
 sudo chmod -R go-w filebeat/
 
 cd filebeat
diff --git a/.buildkite/filebeat/scripts/package.sh b/.buildkite/filebeat/scripts/package.sh
index 2ae226eb739c..0bb03250348c 100755
--- a/.buildkite/filebeat/scripts/package.sh
+++ b/.buildkite/filebeat/scripts/package.sh
@@ -4,9 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Evaluate Filebeat Changes ::"
-
-echo ":: Start Packaging ::"
+echo "--- Start Packaging"
 cd filebeat
 umask 0022
 mage package
diff --git a/.buildkite/filebeat/scripts/unit-tests.sh b/.buildkite/filebeat/scripts/unit-tests.sh
index 0372923e54a7..08ce9d4ea1c6 100755
--- a/.buildkite/filebeat/scripts/unit-tests.sh
+++ b/.buildkite/filebeat/scripts/unit-tests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Unit Tests ::"
+echo "--- Executing Unit Tests"
 sudo chmod -R go-w filebeat/
 
 umask 0022
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index bb2ec48c21bf..35028d76e0d3 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -2,20 +2,12 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/env.sh
-source .buildkite/env-scripts/util.sh
-source .buildkite/env-scripts/win-env.sh
-
-if [[ ( "$BUILDKITE_PIPELINE_SLUG" == "filebeat" || "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" ) ]]; then
-  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
-    install_python_win
-  fi
+if [[ ("$BUILDKITE_PIPELINE_SLUG" == "filebeat" || "$BUILDKITE_PIPELINE_SLUG" == "auditbeat") ]]; then
+  source .buildkite/env-scripts/env.sh
+  source .buildkite/env-scripts/util.sh
+  source .buildkite/env-scripts/win-env.sh
 
   if [[ -z "${GOLANG_VERSION-""}" ]]; then
     export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
   fi
-
-  if [[ "$BUILDKITE_STEP_KEY" == macos* ]]; then
-    ulimit -Sn 30000
-  fi
 fi
diff --git a/.buildkite/pull-requests.json b/.buildkite/pull-requests.json
index 4607a0576d0b..abe0d20f6805 100644
--- a/.buildkite/pull-requests.json
+++ b/.buildkite/pull-requests.json
@@ -57,8 +57,8 @@
             "set_commit_status": true,
             "build_on_commit": true,
             "build_on_comment": true,
-            "trigger_comment_regex": "^/test auditbeat$",
-            "always_trigger_comment_regex": "^/test auditbeat$",
+            "trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
+            "always_trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
             "skip_ci_labels": [  ],
             "skip_target_branches": [ ],
             "skip_ci_on_only_changed": [ ],
diff --git a/auditbeat/magefile.go b/auditbeat/magefile.go
index 0e6e2b487d52..1f17ed60fae6 100644
--- a/auditbeat/magefile.go
+++ b/auditbeat/magefile.go
@@ -21,8 +21,6 @@ package main
 
 import (
 	"fmt"
-	"log"
-	"os"
 	"time"
 
 	"github.com/magefile/mage/mg"
@@ -97,8 +95,6 @@ func Package() {
 	start := time.Now()
 	defer func() { fmt.Println("package ran for", time.Since(start)) }()
 
-	log.SetOutput(os.Stdout)
-
 	devtools.UseElasticBeatOSSPackaging()
 	devtools.PackageKibanaDashboardsFromBuildDir()
 	auditbeat.CustomizePackaging(auditbeat.OSSPackaging)