Closed defendable-forfot closed 6 months ago
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
@vinit-elastic only assigning this to you to ensure these mappings are taking into account as part of the new M365D integration.
Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale
to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1
. Thank you for your contribution!
AFAIK, These fields are covered as part of our new M365 integration. However, @piyush-elastic would you mind confirming and closing this issue?
Closing as our M365 Defender integration address these ECS mapping improvements.
We are ingesting Microsoft ATP and M365 Defender data into our Elasticsearch for search, detection in Elastic Security, and visualization through Kibana. However, we have noticed a few specific fields where the Microsoft module does not optimally utilize ECS.
Note: we are running filebeat version 8.1.3, but have noticed that none of the newer releases solves all our issues. Issue elastic/beats#29859 has solved issues related to one specific field, but we still need more improvements.
Microsoft ATP
M365 Defender
This is a copy of https://discuss.elastic.co/t/microsoft-filebeat-module-lack-of-ecs-utilization/315125, as I was recommended to post this as a GitHub issue instead.