[dashboard-data-scope] High-severity unscoped data-view controls across Microsoft Defender XDR dashboards

## Findings

### 1. Microsoft Defender XDR dashboards use global `logs-*` control data views, causing cross-integration filter pollution

**Why this is a real bug (high severity):**
These dashboards define options-list controls with `dataViewId: "logs-*"`. In environments with multiple integrations installed, control option values (hostname, username, severity, etc.) are pulled from all logs, not just Microsoft Defender XDR data. Users opening these dashboards get unrelated values immediately, making dashboard filtering unreliable.

**Evidence (actual datasource configuration):**

1. `packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json`
- `L15, L34, L53, L72`: `"dataViewId": "logs-*"`
- `L95`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.event` (`L249-L256`)
- **Correct scope:** `logs-m365_defender.event-*`

2. `packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json`
- `L15, L34, L53, L72`: `"dataViewId": "logs-*"`
- `L95`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.event`
- **Correct scope:** `logs-m365_defender.event-*`

3. `packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json`
- `L15, L34, L53, L72`: `"dataViewId": "logs-*"`
- `L95`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.event`
- **Correct scope:** `logs-m365_defender.event-*`

4. `packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json`
- `L15, L34, L53, L72`: `"dataViewId": "logs-*"`
- `L95`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.event`
- **Correct scope:** `logs-m365_defender.event-*`

5. `packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json`
- `L15, L34, L46, L65`: `"dataViewId": "logs-*"`
- `L88`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.alert`
- **Correct scope:** `logs-m365_defender.alert-*`

6. `packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json`
- `L15, L34, L53, L72`: `"dataViewId": "logs-*"`
- `L91`: dashboard search source has `"filter": []`
- Dataset in panel filters: `m365_defender.incident`
- **Correct scope:** `logs-m365_defender.incident-*`

7. `packages/m365_defender/kibana/dashboard/m365_defender-afb93ff7-9903-4d91-9028-9fe9c5a434f8.json`
- `L15, L41, L60, L79`: `"dataViewId": "logs-*"`
- Dataset in panel filters: `m365_defender.vulnerability`
- **Correct scope:** `logs-m365_defender.vulnerability-*`

Data stream scope is confirmed by package manifests:
- `packages/m365_defender/data_stream/alert/manifest.yml:1-2` (`type: logs`)
- `packages/m365_defender/data_stream/event/manifest.yml:1-2` (`type: logs`)
- `packages/m365_defender/data_stream/incident/manifest.yml:1-2` (`type: logs`)
- `packages/m365_defender/data_stream/vulnerability/manifest.yml:1-2` (`type: logs`)

## Additional required categories from this audit

- **Stale `indexPatternId` references producing missing datasource errors:** none newly confirmed in this run (only cases already tracked in existing open `[dashboard-data-scope]` issues).
- **`SVR00002` suppressions without explanation:** none newly confirmed in this package. (`packages/m365_defender/validation.yml` includes comments for suppressions.)

## Suggested Actions

- [ ] Replace all `optionsListControl.explicitInput.dataViewId: "logs-*"` in the 7 dashboards above with dataset-scoped patterns listed per dashboard.
- [ ] Replace any related `references` entries still using global `logs-*` in those dashboards with matching scoped data views.
- [ ] Add/ensure mandatory `data_stream.dataset` filter coverage at dashboard level (not only panel-local filters) so controls stay scoped.
- [ ] Remove temporary broad-data-view usage and re-enable strict validation once scoped.

## Audit coverage

- Total dashboards scanned: **1297**
- Dashboards with confirmed findings: **7** (all in `m365_defender`)

> [!NOTE]
>
> 🔒 Integrity filter blocked 5 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#17567](https://github.com/elastic/integrations/issues/17567) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18277](https://github.com/elastic/integrations/issues/18277) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#16203](https://github.com/elastic/integrations/issues/16203) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#13739](https://github.com/elastic/integrations/issues/13739) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#10562](https://github.com/elastic/integrations/issues/10562) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: Dashboard Data Scope and Filter Integrity](https://github.com/elastic/integrations/actions/runs/26945702272)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Jun 11, 2026, 10:29 AM UTC