[m365_defender] Add support for Streaming Event types

[vinit-chauhan]

What does this PR do?

• Added a data stream.
• Added data collection logic to the data stream.
• Added the ingest pipeline for the data stream.
• Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
• Added dashboards and visualizations.
• Added test for pipeline for the data stream.
• Added system test cases for the data stream.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.16.0 || ^8.0.0).

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/m365_defender directory.
• Run the following command to run tests.

elastic-package test

Screenshots

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-02-07T12:57:40.168+0000

• Duration: 16 min 41 sec

Test stats 🧪

Test	Results
Failed	0
Passed	26
Skipped	0
Total	26

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (3/3)	💚
Files	100.0% (7/7)	💚 6.25
Classes	100.0% (7/7)	💚 6.25
Methods	87.805% (72/82)	👍 1.673
Lines	90.367% (4634/5128)	👍 4.441
Conditionals	100.0% (0/0)	💚

[efd6]

We'll need to have the technique.subtechnique arrays canonicalised since map iteration order is not guaranteed to be consistent.

[efd6]

Sorry for the delay; LGTM

[vinit-chauhan]

Hey @efd6 - Would you mind holding on to the merge for a bit? Jamie and I are to discuss a couple of approaches to disable the deprecated data stream by default. And I might add a commit along with this PR.

Sorry for the inconvenience, I will let you know once we discuss the strategy. 😄

[efd6]

Still LGTM

[elasticmachine]

Package m365_defender - 1.6.0 containing this change is available at https://epr.elastic.co/search?package=m365_defender