elastic / elastic/integrations

[Microsoft Defender for Cloud]: (microsoft_defender_cloud) make OAuth2 endpoint params configurable

Open
#16,135 1 comment 0 reactions 0 assignees View on GitHub
enhancement Integration:microsoft_defender_cloud needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Microsoft Defender for Cloud [microsoft_defender_cloud]

### Dataset Name

- [x] Assessments (cel) - https://github.com/elastic/integrations/pull/16919
- [ ] Events (azure-eventhub)

### Integration Version

3.1.1

### Agent Version

9.2.1

### OS Version and Architecture

Debian

### User Goal

Configure the integration to work with Microsoft's Partner Center and its granular delegated admin privileges ([GDAP](https://learn.microsoft.com/en-us/partner-center/customers/gdap-introduction)) constructs to authorize and collect tenant information.

### Existing Features

Similar to work we previously did for both Microsoft Office 365 (#14924) and Microsoft Defender Endpoint (#15605), we need to expose the "OAuth2 Endpoint Params" via the integration to allow users to modify the `grant_type` and the `refresh_token` value.

### What did you see?

This integrations options: https://www.elastic.co/docs/reference/integrations/microsoft_defender_cloud

The other integration options:
- https://www.elastic.co/docs/reference/integrations/o365
- https://www.elastic.co/docs/reference/integrations/microsoft_defender_endpoint

### Anything else?

Similar to https://github.com/elastic/integrations/issues/15605, https://github.com/elastic/integrations/pull/14924, and #16134.

Depends on #16408, #16586, and https://github.com/elastic/beats/pull/47256.
Depends on https://github.com/elastic/beats/issues/48479.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.