elastic / elastic/integrations

[microsoft_exchange_online_message_trace]: Add option to preserve Microsoft tenant id

Open
#19,285 4 comments 0 reactions 0 assignees View on GitHub
Integration:microsoft_exchange_online_message_trac needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Microsoft Exchange Online Message Trace [packages/microsoft_exchange_online_message_trace]

### Dataset Name

microsoft_exchange_online_message_trace.log

### Integration Version

2.1.0

### Agent Version

8.19.7

### OS Version and Architecture

Ubuntu LTS

### User Goal

We are operating as a Managed Security Services Provider and are processing message trace data from multiple customers.
Currently, we are not able to determine which integrations are actively sending data as there is no way of determining which log is linked to which Microsoft tenant.

### Existing Features

With the current logging, there is no way to determine the originating Microsoft tenant for a message trace log.

### What did you see?

With the current logging, there is no way to determine the originating Microsoft tenant for a message trace log.

### Anything else?

A possible solution would be to store the `tenant_id` in the document such that it is available within the search.
This feature could be blocked behind a toggle in the integration settings.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.