[microsoft_defender_endpoint] Add Initial Interval in Config Options

[mohitjha-elastic]

Proposed Commit Message

microsoft_defender_endpoint: add configurable initial interval to the log data stream.

Previously, the initial interval was hardcoded to "5m" and not exposed
in the configuration options in log data stream. This update adds it as
a configurable option, with a default value of "5m". It allows users to
define how far back they want to pull data from the API.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/microsoft_defender_endpoint directory.
Run the following command to run tests.
elastic-package test -v

Related issues

• Closes [microsoft/defender_atp]: Offer initial_interval instead of hardcoding to 5m #12912

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

nit only, then LGTM

[efd6]

Suggested change

	- description: Added support for `Initial Interval` in Config Options.
	- description: Added support for Initial Interval in Config Options.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: f164061

History

• 💚 Build #27688 succeeded b44a0c7

cc @mohitjha-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package microsoft_defender_endpoint - 2.40.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_endpoint/2.40.0/