elastic / elastic/integrations

[m365] M365 Defender Fingerprint not able to sync changes from M365 Portal

Open
#8,231 7 comments 0 reactions 1 assignee Claimed by @chemamartinez View on GitHub
Integration:m365_defender Team:Security-Service Integrations troubleshooting
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

It appears that the M365 Defender Integration is creating a fingerprint based on some lastUpdate times:

https://github.com/elastic/integrations/blob/d38087c71ce6dd66bc63ef08935f6e4e02777c38/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml#L26-L35

This is a problem because there are multiple events/documents for a single incident and when the incident's status changes from new to resolved, only 1 of the documents is updated to reflect this change in Elastic. This will then in turn effect the dashboard and show incorrect results on active/resolved incidents. I am sure this will apply to alerts as well.

I recommend testing the removal of:
```
- json.lastUpdateDateTime
- json.alerts.lastUpdateDateTime
```

To see if that resolves the issue.

I have tested this in my own environment and it seems to work well but it makes sense for the creator of this integration to check and make sure there isn't any other use cases I may be missing.

Here is part of what the issue looks like:
![image](https://github.com/elastic/integrations/assets/5582679/03efd4f6-e99d-4bc9-a83c-23ff194e91a3)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.