[m365_defender] Add support for newer Oauth Token Endpoint and fixes in some ECS mappings. #7119
Conversation
|
💚 CLA has been signed |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
|
@mohitjha-elastic Can you please sign the CLA so that we can take a look at this? If you have signed, please check that the email address that you used to sign the CLA agrees with the email address used in the commit. |
|
Hey @dan Kortschak ***@***.***>,
Yes, I have already signed the CLA with the same email address which I used
in the commit.
I am attaching the CLA signed document for your reference.
Thanks,
Mohit Jha
…On Tue, Jul 25, 2023 at 12:08 PM Dan Kortschak ***@***.***> wrote:
@mohitjha-elastic <https://github.com/mohitjha-elastic> Can you please
sign the CLA so that we can take a look at this? If you have signed, please
check that the email address that you used to sign the CLA agrees with the
email address used in the commit.
—
Reply to this email directly, view it on GitHub
<#7119 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BBDQ45CDEAD5OQGRWCP5VUTXR5SW7ANCNFSM6AAAAAA2VQMBTU>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
/test |
🌐 Coverage report
|
There was a problem hiding this comment.
Is there an issue describing the things being fixed in this file?
There was a problem hiding this comment.
Nope. The issue is not raised but these changes are being raised and discussed in the slack.
Attaching the conversation link -https://elastic.slack.com/archives/C05BFTCELUR/p1689232086966929
There was a problem hiding this comment.
Thanks. I'll summarise that when I merge.
…appings. The m365 ipAddress field was being used to populate the host.ip field, but this field defined in the API as the IP address of the alert entity[1], so this is changed to reflect that it is the source IP. The UPN (as user.email) is used as the user.id to conform with the situation in o365. [1]https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-list-incidents?view=o365-worldwide
… syntax, but it is not necessarily the case that the UPN is always an email address.
|
/test |
|
Package m365_defender - 1.17.0 containing this change is available at https://epr.elastic.co/search?package=m365_defender |
Type of change
What does this PR do?
Add support for newer Oauth Token Endpoint and fixes in some ECS mappings.
Checklist
changelog.ymlfile.How to test this PR locally
Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/m365_defender directory.
Run the following command to run tests.
Automated Test