[microsoft_defender_endpoint] Add machine and machine action data streams

[brijesh-elastic]

Proposed commit message

microsoft_defender_endpoint: add support for machine and machine_action data streams

This update adds support for machine and machine action logs to enhance
data ingestion, enabling improved bidirectional response actions.

Sanitized test case inputs were obtained from live Microsoft Defender
for Endpoint instance using the Machine API and Machine Action API.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/microsoft_defender_endpoint directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Relates Standardize Ingested Data for Response Actions #12563

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Suggest this for the commit message (the API docs are already referenced in the change, so they don't need to be in the commit message, but also, no markdown in git logs, and wrap)

microsoft_defender_endpoint: add support for machine and machine_action data streams

This update adds support for machine and machine action logs to enhance
data ingestion, enabling improved bidirectional response actions.

Sanitized test case inputs were obtained from live Microsoft Defender
for Endpoint instance using the Machine API and Machine Action API.

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
93.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: be0a7d0

History

• 💚 Build #24710 succeeded 97165de

cc @brijesh-elastic

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package microsoft_defender_endpoint - 2.33.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_endpoint/2.33.0/