diff --git a/.buildkite/scripts/changesets.psm1 b/.buildkite/scripts/changesets.psm1
new file mode 100644
index 000000000000..25ec435ab9cb
--- /dev/null
+++ b/.buildkite/scripts/changesets.psm1
@@ -0,0 +1,76 @@
+function ArePathsChanged($patterns) {
+    $changedlist = @()
+    foreach ($pattern in $patterns) {
+        $changedFiles = & git diff --name-only "HEAD@{1}" HEAD | Select-String -Pattern $pattern
+        if ($changedFiles) {
+            $changedlist += $changedFiles
+        }
+    }
+    if ($changedlist) {
+        Write-Output "--- Files changed:"
+        Write-Output $changedlist
+        return $true
+    }
+    else {
+        Write-Output "--- No files changed within specified changeset:"
+        Write-Output $patterns
+        return $false
+    }
+}
+
+function AreChangedOnlyPaths($patterns) {
+    $changedFiles = & git diff --name-only "HEAD@{1}" HEAD
+    $matchedFiles = @()
+    foreach ($pattern in $patterns) {
+        $matched = $changedFiles | Select-String -Pattern $pattern
+        if ($matched) {
+            $matchedFiles += $matched
+        }
+    }
+    if (($matchedFiles.Count -eq $changedFiles.Count) -or ($changedFiles.Count -eq 0)) {
+        return $true
+    }
+    return $false
+}
+
+# This function sets a `MODULE` env var, required by IT tests, containing a comma separated list of modules for a given beats project (specified via the first argument).
+# The list is built depending on directories that have changed under `modules/` excluding anything else such as asciidoc and png files.
+# `MODULE` will empty if no changes apply.
+function DefineModuleFromTheChangeSet($projectPath) {
+    $projectPathTransformed = $projectPath -replace '/', '\\'
+    $projectPathExclusion = "((?!^$projectPathTransformed\\\/).)*\$"
+    $exclude = @("^($projectPathExclusion|((?!\\/module\\/).)*\$|.*\\.asciidoc|.*\\.png)")
+
+    $changedModules = ''
+
+    $moduleDirs = Get-ChildItem -Directory "$projectPath\module"
+    foreach($moduleDir in $moduleDirs) {
+        if((ArePathsChanged($moduleDir)) -and !(AreChangedOnlyPaths($exclude))) {
+            if(!$changedModules) {
+                $changedModules = $moduleDir.Name
+            }
+            else {
+                $changedModules += ',' + $moduleDir.Name
+            }
+        }
+    }
+
+    # TODO: remove this conditional when issue https://github.com/elastic/ingest-dev/issues/2993 gets resolved
+    if(!$changedModules) {
+        Write-Output "--- CHANGED MODULES: $changedModules"
+        Write-Output "--- DEFINING MODULE"
+        Write-Output "--- Slug: $Env:BUILDKITE_PIPELINE_SLUG"
+
+        if($Env:BUILDKITE_PIPELINE_SLUG -eq 'beats-xpack-metricbeat') {
+            $Env:MODULE = "aws"
+        }
+        else {
+            # TODO: once https://github.com/elastic/ingest-dev/issues/2993 gets resolved, this should be the only thing we export
+            $Env:MODULE = "kubernetes"
+        }
+    }
+    else {
+        Write-Output "--- CHANGE MODULES not defined"
+        $Env:MODULE = $changedModules
+    }
+}
diff --git a/.buildkite/scripts/changesets.sh b/.buildkite/scripts/changesets.sh
index 3b7ed5d7ec00..0f73a3ed954a 100644
--- a/.buildkite/scripts/changesets.sh
+++ b/.buildkite/scripts/changesets.sh
@@ -56,6 +56,7 @@ defineModuleFromTheChangeSet() {
   else
     local pattern=("$OSS_MODULE_PATTERN")
   fi
+
   local changed_modules=""
   local module_dirs=$(find "$project_path/module" -mindepth 1 -maxdepth 1 -type d)
   for module_dir in $module_dirs; do
diff --git a/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml b/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml
index e1e2ec3e045d..9657c2800cad 100644
--- a/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml
+++ b/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml
@@ -22,7 +22,10 @@ steps:
       - label: ":windows: Xpack/Winlogbeat Win-2019 Unit (MODULE) Tests"
         key: "mandatory-win-2019-module-unit-tests"
         command: |
-          Set-Location -Path x-pack/winlogbeat
+          Import-Module .\.buildkite\scripts\changesets.psm1
+          defineModuleFromTheChangeSet 'x-pack\winlogbeat'
+          Write-Output "~~~ Will run tests with env var MODULE=$Env:MODULE"
+          Set-Location -Path x-pack\winlogbeat
           mage build unitTest
         env:
           MODULE: $MODULE
@@ -39,41 +42,41 @@ steps:
           - github_commit_status:
               context: "Xpack/Winlogbeat Win-2019 Unit (MODULE) Tests"
 
-      - label: ":windows: Xpack/Winlogbeat Win-2016 Unit Tests"
-        command: |
-          Set-Location -Path x-pack/winlogbeat
-          mage build unitTest
-        key: "mandatory-win-2016-unit-tests"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_WIN_2016}"
-          machine_type: "${GCP_WIN_MACHINE_TYPE}"
-          disk_size: 100
-          disk_type: "pd-ssd"
-        artifact_paths:
-          - "x-pack/winlogbeat/build/*.xml"
-          - "x-pack/winlogbeat/build/*.json"
-        notify:
-          - github_commit_status:
-              context: "Xpack/Winlogbeat Win-2016 Unit Tests"
-
-      - label: ":windows: Xpack/Winlogbeat Win-2022 Unit Tests"
-        command: |
-          Set-Location -Path x-pack/winlogbeat
-          mage build unitTest
-        key: "mandatory-win-2022-unit-tests"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_WIN_2022}"
-          machine_type: "${GCP_WIN_MACHINE_TYPE}"
-          disk_size: 100
-          disk_type: "pd-ssd"
-        artifact_paths:
-          - "x-pack/winlogbeat/build/*.xml"
-          - "x-pack/winlogbeat/build/*.json"
-        notify:
-          - github_commit_status:
-              context: "Xpack/Winlogbeat Win-2022 Unit Tests"
+#      - label: ":windows: Xpack/Winlogbeat Win-2016 Unit Tests"
+#        command: |
+#          Set-Location -Path x-pack/winlogbeat
+#          mage build unitTest
+#        key: "mandatory-win-2016-unit-tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_WIN_2016}"
+#          machine_type: "${GCP_WIN_MACHINE_TYPE}"
+#          disk_size: 100
+#          disk_type: "pd-ssd"
+#        artifact_paths:
+#          - "x-pack/winlogbeat/build/*.xml"
+#          - "x-pack/winlogbeat/build/*.json"
+#        notify:
+#          - github_commit_status:
+#              context: "Xpack/Winlogbeat Win-2016 Unit Tests"
+#
+#      - label: ":windows: Xpack/Winlogbeat Win-2022 Unit Tests"
+#        command: |
+#          Set-Location -Path x-pack/winlogbeat
+#          mage build unitTest
+#        key: "mandatory-win-2022-unit-tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_WIN_2022}"
+#          machine_type: "${GCP_WIN_MACHINE_TYPE}"
+#          disk_size: 100
+#          disk_type: "pd-ssd"
+#        artifact_paths:
+#          - "x-pack/winlogbeat/build/*.xml"
+#          - "x-pack/winlogbeat/build/*.json"
+#        notify:
+#          - github_commit_status:
+#              context: "Xpack/Winlogbeat Win-2022 Unit Tests"
 
   - group: "Extended Windows Tests"
     key: "extended-win-tests"
@@ -134,30 +137,30 @@ steps:
           - github_commit_status:
               context: "x-pack/winlogbeat: Win-2019 Unit Tests"
 
-  - wait: ~
-    # with PRs, we want to run packaging only if mandatory tests succeed
-    # for other cases, e.g. merge commits, we want to run packaging (and publish) independently of other tests
-    # this allows building DRA artifacts even if there is flakiness in mandatory tests
-    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
-    depends_on:
-      - "xpack-winlogbeat-mandatory-tests"
-
-  - group: "Xpack/Winlogbeat Packaging"
-    key: "xpack-winlogbeat-packaging"
-
-    steps:
-      - label: ":ubuntu: Packaging Linux"
-        key: "packaging-linux"
-        command: "cd x-pack/winlogbeat && mage package"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_UBUNTU_X86_64}"
-          machineType: "${GCP_HI_PERF_MACHINE_TYPE}"
-          disk_size: 100
-          disk_type: "pd-ssd"
-        env:
-          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
-        notify:
-          - github_commit_status:
-              context: "Xpack/Winlogbeat Packaging"
+#  - wait: ~
+#    # with PRs, we want to run packaging only if mandatory tests succeed
+#    # for other cases, e.g. merge commits, we want to run packaging (and publish) independently of other tests
+#    # this allows building DRA artifacts even if there is flakiness in mandatory tests
+#    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+#    depends_on:
+#      - "xpack-winlogbeat-mandatory-tests"
+#
+#  - group: "Xpack/Winlogbeat Packaging"
+#    key: "xpack-winlogbeat-packaging"
+#
+#    steps:
+#      - label: ":ubuntu: Packaging Linux"
+#        key: "packaging-linux"
+#        command: "cd x-pack/winlogbeat && mage package"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_UBUNTU_X86_64}"
+#          machineType: "${GCP_HI_PERF_MACHINE_TYPE}"
+#          disk_size: 100
+#          disk_type: "pd-ssd"
+#        env:
+#          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
+#        notify:
+#          - github_commit_status:
+#              context: "Xpack/Winlogbeat Packaging"