Skip to content

[Microsoft Defeder XDR] Add behavior and messsage events - #17512

Merged
moxarth-rathod merged 7 commits into
elastic:mainfrom
moxarth-rathod:m365-defender-17230
Feb 26, 2026
Merged

[Microsoft Defeder XDR] Add behavior and messsage events#17512
moxarth-rathod merged 7 commits into
elastic:mainfrom
moxarth-rathod:m365-defender-17230

Conversation

@moxarth-rathod

@moxarth-rathod moxarth-rathod commented Feb 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

m365_defender: add support for behavior and message tables

This extends the integration to handle BehaviorInfo, BehaviorEntities, 
MessageEvents, MessageUrlInfo, and MessagePostDeliveryEvents tables from 
the Microsoft 365 Defender Advanced Hunting API, enabling richer threat 
detection and email security monitoring.

Test logs were generated based on documentation.

API documentation:
- MessageEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-messageevents-table
- BehaviorInfo: https://docs.azure.cn/en-us/azure-monitor/reference/tables/behaviorinfo
- Advanced Hunting API: https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/m365_defender directory.
  • Run the following command to run tests.

elastic-package test

Related issues
@moxarth-rathod moxarth-rathod self-assigned this Feb 23, 2026
@moxarth-rathod
moxarth-rathod requested a review from a team as a code owner February 23, 2026 06:19
@moxarth-rathod moxarth-rathod added enhancement New feature or request Integration:m365_defender Microsoft Defender XDR Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Feb 23, 2026
@elasticmachine

elasticmachine commented Feb 23, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@github-actions

github-actions Bot commented Feb 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Vale Linting Results

Summary: 2 warnings found

⚠️ Warnings (2)
File Line Rule Message
packages/m365_defender/docs/README.md 652 Elastic.DontUse Don't use 'thus'.
packages/m365_defender/docs/README.md 665 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.
@andrewkroh andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Feb 23, 2026
@kcreddy
kcreddy self-requested a review February 24, 2026 16:59
kcreddy

This comment was marked as outdated.

Sign in to view

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Feb 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
kcreddy
kcreddy reviewed Feb 26, 2026
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following commit message suggested by Remy:

m365_defender: add support for behavior and message tables

This extends the integration to handle BehaviorInfo, BehaviorEntities, 
MessageEvents, MessageUrlInfo, and MessagePostDeliveryEvents tables from 
the Microsoft 365 Defender Advanced Hunting API, enabling richer threat 
detection and email security monitoring.

Test logs were generated based on documentation.

API documentation:
- MessageEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-messageevents-table
- BehaviorInfo: https://docs.azure.cn/en-us/azure-monitor/reference/tables/behaviorinfo
- Advanced Hunting API: https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api
Comment thread packages/m365_defender/_dev/build/docs/README.md Outdated
Comment thread packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_email.yml
@elasticmachine

elasticmachine commented Feb 26, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @moxarth-rathod
@moxarth-rathod
moxarth-rathod merged commit f5f9fe2 into elastic:main Feb 26, 2026
11 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Feb 26, 2026

Copy link
Copy Markdown
Contributor

Package m365_defender - 5.10.0 containing this change is available at https://epr.elastic.co/package/m365_defender/5.10.0/
ilyannn pushed a commit that referenced this pull request Feb 28, 2026
@moxarth-rathod @ilyannn
[Microsoft Defeder XDR] Add behavior and messsage events (#17512)
dbf43fb 
m365_defender: add support for behavior and message tables

This extends the integration to handle BehaviorInfo, BehaviorEntities, 
MessageEvents, MessageUrlInfo, and MessagePostDeliveryEvents tables from 
the Microsoft 365 Defender Advanced Hunting API, enabling richer threat 
detection and email security monitoring.

Test logs were generated based on documentation.

API documentation:
- MessageEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-messageevents-table
- BehaviorInfo: https://docs.azure.cn/en-us/azure-monitor/reference/tables/behaviorinfo
- Advanced Hunting API: https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api
navnit-elastic pushed a commit to navnit-elastic/integrations that referenced this pull request Mar 2, 2026
@moxarth-rathod Navnit Chauhan
[Microsoft Defeder XDR] Add behavior and messsage events (elastic#17512)
0248f49 
m365_defender: add support for behavior and message tables

This extends the integration to handle BehaviorInfo, BehaviorEntities, 
MessageEvents, MessageUrlInfo, and MessagePostDeliveryEvents tables from 
the Microsoft 365 Defender Advanced Hunting API, enabling richer threat 
detection and email security monitoring.

Test logs were generated based on documentation.

API documentation:
- MessageEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-messageevents-table
- BehaviorInfo: https://docs.azure.cn/en-us/azure-monitor/reference/tables/behaviorinfo
- Advanced Hunting API: https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api
@moxarth-rathod moxarth-rathod mentioned this pull request Mar 6, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:m365_defender Microsoft Defender XDR Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

4 participants

@moxarth-rathod @elasticmachine @kcreddy @andrewkroh