Integration Name
Microsoft Defender XDR [m365_defender]
Dataset Name
m365_defender.event
Integration Version
5.5.0
Agent Version
9.2.4
OS Version and Architecture
RHEL 9 x86_64
User Goal
Microsoft has added additional tables tothe M365 Defender XDR Streaming API.
These are not supported by the integration.
Existing Features
All of the other tables are supported, but these ones are not.
The ingest pipeline checks an enumerated list and appends an error if the category is not listed
- append:
field: error.message
value: 'The event category {{{m365_defender.event.category}}} is not supported.'
tag: append_invalid_m365_defender_event_category
if: ctx.m365_defender?.event?.category != null && !['AdvancedHunting-AlertEvidence','AdvancedHunting-AlertInfo','AdvancedHunting-DeviceEvents','AdvancedHunting-DeviceFileCertificateInfo','AdvancedHunting-DeviceFileEvents','AdvancedHunting-DeviceImageLoadEvents','AdvancedHunting-DeviceInfo','AdvancedHunting-DeviceLogonEvents','AdvancedHunting-DeviceNetworkEvents','AdvancedHunting-DeviceNetworkInfo','AdvancedHunting-DeviceProcessEvents','AdvancedHunting-DeviceRegistryEvents','AdvancedHunting-EmailAttachmentInfo','AdvancedHunting-EmailEvents','AdvancedHunting-EmailPostDeliveryEvents','AdvancedHunting-EmailUrlInfo','AdvancedHunting-IdentityLogonEvents','AdvancedHunting-IdentityQueryEvents','AdvancedHunting-IdentityDirectoryEvents', 'AdvancedHunting-IdentityInfo','AdvancedHunting-CloudAppEvents','AdvancedHunting-UrlClickEvents'].contains(ctx.m365_defender.event.category)
What did you see?
{
"@timestamp": "2026-02-03T22:18:32.571Z",
"agent.ephemeral_id": "z",
"agent.id": "z",
"agent.name": "z",
"agent.type": "filebeat",
"agent.version": "9.2.4",
"azure.consumer_group": "$Default",
"azure.enqueued_time": "2026-02-04T10:28:09.664Z",
"azure.eventhub": "advancedhuntinghub",
"azure.offset": x,
"azure.sequence_number": x,
"data_stream.dataset": "m365_defender.event",
"data_stream.namespace": "default",
"data_stream.type": "logs",
"ecs.version": "8.11.0",
"elastic_agent.id": "x",
"elastic_agent.snapshot": false,
"elastic_agent.version": "9.2.4",
"error.message": "The event category AdvancedHunting-MessageEvents is not supported.",
"event.agent_id_status": "verified",
"event.dataset": "m365_defender.event",
"event.ingested": "2026-02-04T10:28:16.000Z",
"event.module": "m365_defender",
"input.type": "azure-eventhub",
"m365_defender.event.category": "AdvancedHunting-MessageEvents",
"m365_defender.event.operation_name": "Publish",
"m365_defender.event.tenant.id": "x",
"m365_defender.event.tenant.name": "DefaultTenant",
"m365_defender.event.time": "2026-02-03T22:20:31.603Z",
"m365_defender.event.timestamp": "2026-02-03T22:18:32.571Z",
"tags": [
"forwarded",
"m365_defender-event",
"preserve_duplicate_custom_fields"
]
}
Anything else?
No response
Integration Name
Microsoft Defender XDR [m365_defender]
Dataset Name
m365_defender.event
Integration Version
5.5.0
Agent Version
9.2.4
OS Version and Architecture
RHEL 9 x86_64
User Goal
Microsoft has added additional tables tothe M365 Defender XDR Streaming API.
These are not supported by the integration.
Existing Features
All of the other tables are supported, but these ones are not.
The ingest pipeline checks an enumerated list and appends an error if the category is not listed
What did you see?
Anything else?
No response