elastic / elastic/integrations
[microsoft_exchange_online_message_trace]: Add option to preserve Microsoft tenant id
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Microsoft Exchange Online Message Trace [packages/microsoft_exchange_online_message_trace]
### Dataset Name
microsoft_exchange_online_message_trace.log
### Integration Version
2.1.0
### Agent Version
8.19.7
### OS Version and Architecture
Ubuntu LTS
### User Goal
We are operating as a Managed Security Services Provider and are processing message trace data from multiple customers.
Currently, we are not able to determine which integrations are actively sending data as there is no way of determining which log is linked to which Microsoft tenant.
### Existing Features
With the current logging, there is no way to determine the originating Microsoft tenant for a message trace log.
### What did you see?
With the current logging, there is no way to determine the originating Microsoft tenant for a message trace log.
### Anything else?
A possible solution would be to store the `tenant_id` in the document such that it is available within the search.
This feature could be blocked behind a toggle in the integration settings.
Contributor guide
Assessment
This issue has not been assessed yet.