elastic / elastic/integrations
[Microsoft Defender XDR]: (m365_defender) make OAuth2 endpoint params configurable
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Microsoft Defender XDR [m365_defender]
### Dataset Name
- [x] Alert (httpjson) - https://github.com/elastic/integrations/pull/16628
- [ ] Event (azure-eventhub)
- [x] Incident (httpjson) - https://github.com/elastic/integrations/pull/16628
- [x] Vulnerability (cel) - https://github.com/elastic/integrations/pull/15749
### Integration Version
5.1.1
### Agent Version
9.2.1
### OS Version and Architecture
Debian
### User Goal
Configure the integration to work with Microsoft's Partner Center and its granular delegated admin privileges ([GDAP](https://learn.microsoft.com/en-us/partner-center/customers/gdap-introduction)) constructs to authorize and collect tenant information.
### Existing Features
Similar to work we previously did for both Microsoft Office 365 (#14924) and Microsoft Defender Endpoint (#15605), we need to expose the "OAuth2 Endpoint Params" via the integration to allow users to modify the `grant_type` and the `refresh_token` value.
### What did you see?
This integrations options: https://www.elastic.co/docs/reference/integrations/m365_defender
The other integration options:
- https://www.elastic.co/docs/reference/integrations/o365
- https://www.elastic.co/docs/reference/integrations/microsoft_defender_endpoint
### Anything else?
Similar to https://github.com/elastic/integrations/issues/15605 and https://github.com/elastic/integrations/pull/14924.
Depends on #16408, https://github.com/elastic/beats/pull/47256, and #16586.
Depends on https://github.com/elastic/beats/issues/48479.
Contributor guide
Assessment
This issue has not been assessed yet.