elastic / elastic/integrations
[m365] M365 Defender Fingerprint not able to sync changes from M365 Portal
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
It appears that the M365 Defender Integration is creating a fingerprint based on some lastUpdate times:
https://github.com/elastic/integrations/blob/d38087c71ce6dd66bc63ef08935f6e4e02777c38/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml#L26-L35
This is a problem because there are multiple events/documents for a single incident and when the incident's status changes from new to resolved, only 1 of the documents is updated to reflect this change in Elastic. This will then in turn effect the dashboard and show incorrect results on active/resolved incidents. I am sure this will apply to alerts as well.
I recommend testing the removal of:
```
- json.lastUpdateDateTime
- json.alerts.lastUpdateDateTime
```
To see if that resolves the issue.
I have tested this in my own environment and it seems to work well but it makes sense for the creator of this integration to check and make sure there isn't any other use cases I may be missing.
Here is part of what the issue looks like:

Contributor guide
Assessment
This issue has not been assessed yet.