elastic / elastic/integrations

[Microsoft Defender XDR]: (m365_defender) make OAuth2 endpoint params configurable

Open
#16,134 2 comments 0 reactions 0 assignees View on GitHub
Category: Integration quality enhancement Integration:m365_defender needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Microsoft Defender XDR [m365_defender]

### Dataset Name

- [x] Alert (httpjson) - https://github.com/elastic/integrations/pull/16628
- [ ] Event (azure-eventhub)
- [x] Incident (httpjson) - https://github.com/elastic/integrations/pull/16628
- [x] Vulnerability (cel) - https://github.com/elastic/integrations/pull/15749

### Integration Version

5.1.1

### Agent Version

9.2.1

### OS Version and Architecture

Debian

### User Goal

Configure the integration to work with Microsoft's Partner Center and its granular delegated admin privileges ([GDAP](https://learn.microsoft.com/en-us/partner-center/customers/gdap-introduction)) constructs to authorize and collect tenant information.

### Existing Features

Similar to work we previously did for both Microsoft Office 365 (#14924) and Microsoft Defender Endpoint (#15605), we need to expose the "OAuth2 Endpoint Params" via the integration to allow users to modify the `grant_type` and the `refresh_token` value.

### What did you see?

This integrations options: https://www.elastic.co/docs/reference/integrations/m365_defender

The other integration options:
- https://www.elastic.co/docs/reference/integrations/o365
- https://www.elastic.co/docs/reference/integrations/microsoft_defender_endpoint

### Anything else?

Similar to https://github.com/elastic/integrations/issues/15605 and https://github.com/elastic/integrations/pull/14924.
Depends on #16408, https://github.com/elastic/beats/pull/47256, and #16586.
Depends on https://github.com/elastic/beats/issues/48479.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.