[dashboard-data-scope] High-severity unscoped Microsoft Defender XDR dashboard controls query global logs-*

## Findings

### 1. Microsoft Defender XDR dashboards use global `logs-*` as control data source

`m365_defender` dashboards define options-list controls with `"dataViewId": "logs-*"`, so control values are read from all logs integrations instead of only Microsoft Defender XDR data.

**Locations (control sources):**
- `packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json:15,34,53,72`
- `packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json:15,34,53,72`
- `packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json:15,34,53,72`
- `packages/m365_defender/kibana/dashboard/m365_defender-afb93ff7-9903-4d91-9028-9fe9c5a434f8.json:15,41,60,79`
- `packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json:15,34,53,72`
- `packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json:15,34,53,72`
- `packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json:15,34,46,65`

**Concrete evidence:**
- Controls in these dashboards resolve generic fields (for example `host.name`, `user.name`, `event.severity`, `event.provider`, `email.direction`) while bound to `logs-*`.
- Example: `m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json` includes `"dataViewId": "logs-*"` and a control on `email.direction`.

**What is wrong:**
Controls are querying a global logs data view, not a package-scoped Microsoft Defender XDR data view.

**Why it matters (high severity):**
Users with multiple integrations installed will see cross-integration values in these dropdowns (e.g., `host.name`, `user.name`, `event.severity`, `email.direction` from unrelated packages), which immediately breaks filtering semantics on Microsoft Defender XDR dashboards.

**Correct scoped source:**
This package’s streams are all `type: logs` (`alert`, `event`, `incident`, `vulnerability`), so controls should be scoped to Defender datasets, e.g. `logs-m365_defender.*-*` (or explicit per-dataset patterns such as `logs-m365_defender.alert-*`, `logs-m365_defender.event-*`, etc.).

Data stream evidence:
- `packages/m365_defender/data_stream/alert/manifest.yml:2`
- `packages/m365_defender/data_stream/event/manifest.yml:2`
- `packages/m365_defender/data_stream/incident/manifest.yml:2`
- `packages/m365_defender/data_stream/vulnerability/manifest.yml:2`

## Additional audit outcomes

### Stale static `indexPatternId` references
No new high-severity stale `indexPatternId` findings survived verification beyond already-tracked reports.

### `SVR00002` suppressions without explanation
No new unexplained `SVR00002` suppression finding for this package (`packages/m365_defender/validation.yml` includes an inline explanation).

## Suggested Actions

- [ ] Replace `"dataViewId": "logs-*"` in the seven dashboards above with package-scoped Defender data views.
- [ ] Rebuild controls to use `logs-m365_defender.*-*` (or specific `logs-m365_defender.-*`) and verify dropdown values are integration-local.
- [ ] Add/extend validation coverage so future dashboard regeneration cannot reintroduce global `logs-*` control sources.

## Audit Coverage

- Total dashboards scanned: **1286**
- Dashboards with confirmed findings: **7** (all in `m365_defender`)
- Likely introducing commit for this pattern family (history check): `1d0007ab16` (`[M365 Defender][Microsoft Defender Endpoint] Add support of vulnerability data-stream (#13595)`).

> [!NOTE]
>
> 🔒 Integrity filter blocked 2 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#18277](https://github.com/elastic/integrations/issues/18277) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17567](https://github.com/elastic/integrations/issues/17567) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: Dashboard Data Scope and Filter Integrity](https://github.com/elastic/integrations/actions/runs/26219888987)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 28, 2026, 10:37 AM UTC