[New Integration] Microsoft Purview

**Description**
Microsoft Purview Data Loss Prevention (DLP) is a cloud-native solution that helps organizations protect sensitive data and prevent its accidental or unauthorized exposure. Integrated across Microsoft 365 services like Exchange, SharePoint, OneDrive, Teams, and endpoint devices, Purview DLP identifies sensitive information through predefined or custom policies and takes actions such as alerting, blocking, or restricting data sharing based on organizational compliance requirements.

Security operations teams rely on visibility into DLP events to monitor for potential data exfiltration attempts, policy violations, and insider risk activities. Integrating Microsoft Purview DLP with Elastic Security enables SOC teams to centralize DLP events alongside other security telemetry, providing greater visibility into suspicious file access, data handling policy violations, and potential data exfiltration attempts for faster detection and investigation.

**Use Cases**
This integration involves two key components:

- Ingesting file metadata from Microsoft Purview, including classification labels and file GUIDs, to establish context around sensitive files across the environment.

- Ingesting audit logs from Purview, which capture user activity and access attempts related to those files.

Together, these data sources enable security teams to monitor for suspicious or unauthorized access attempts, policy violations, and potential data exfiltration. For example, users can create detection rules like “If a file labeled ‘Highly Confidential’ is accessed by an unauthorized user, generate an alert.”

**Architecture**
Engineering research and input is definitely required here, but the Catalog API and Graph API seem to be the most relevant API's for our use case.

**Getting File Metadata from Microsoft Purview**
Microsoft Purview’s [Catalog APIs](https://learn.microsoft.com/en-us/rest/api/purview/catalogdataplane/) let you query metadata about assets (like files, databases, tables, etc.) that have been scanned and classified. Need to confirm if we ingest this metadata constantly or do we have to ingest and regular intervals and keep a cache of the latest metadata.

A sample event looks something like this:

```
{
"referredEntities": {},
"entity": {
"typeName": "azure_blob",
"attributes": {
"qualifiedName": "https://myaccount.blob.core.windows.net/container/myfile.docx",
"name": "myfile.docx",
"path": "https://myaccount.blob.core.windows.net/container/myfile.docx",
"lastModified": "2024-06-01T14:32:00.000Z",
"fileSize": 512000,
"classification": ["Highly Confidential"],
"sensitivityLabel": "Confidential",
"guid": "e3a74d85-14c1-4a6e-8432-8c711b123456"
},
"guid": "e3a74d85-14c1-4a6e-8432-8c711b123456",
"status": "ACTIVE",
"createdBy": "scanner_service",
"updatedBy": "scanner_service",
"createTime": 1717330120000,
"updateTime": 1717330120000
}
}
```

**Audit Logs for Access Events**
The DLP audit events (file access attempts, policy violations, etc.) are captured via Microsoft 365 Unified Audit Logs, which you can ingest separately through the Microsoft Graph Security API or Office 365 Management Activity API. We may potentially cover these events already through our O365 integration, as we mention DLP in our [docs](https://www.elastic.co/docs/reference/integrations/o365/#setup). This could be a considered a legacy approach and need to confirm if the Purview Unified Audit Log is a better long term option.

```
{
"CreationTime": "2025-06-05T14:28:33Z",
"Id": "d4f7a8c1-1234-5678-9abc-abcdef123456",
"RecordType": 80,
"Operation": "FileAccessed",
"OrganizationId": "abcdef12-3456-7890-abcd-ef1234567890",
"UserId": "jane.doe@example.com",
"Workload": "SharePoint",
"ClientIP": "203.0.113.42",
"ObjectId": "https://contoso.sharepoint.com/sites/Finance/ConfidentialReports/Q2_Results.xlsx",
"ObjectType": "File",
"UserType": "Member",
"ResultStatus": "Success",
"ExtendedProperties": {
"SensitivityLabel": "Confidential - Finance",
"LabelId": "c1a23d45-e678-90ab-cdef-1234567890ab",
"LabelName": "Confidential",
"LabelMethod": "Manual",
"PolicyName": "Confidential Data Protection",
"PolicyId": "policy-7890-abc-def-4567"
},
"Details": "User accessed a file labeled as 'Confidential'."
}
```