Skip to content

[m365_defender] Introduce Include Alerts configuration option - #18155

Merged
brijesh-elastic merged 3 commits into
elastic:mainfrom
brijesh-elastic:m365_defender-5.12.3
Mar 31, 2026
Merged

[m365_defender] Introduce Include Alerts configuration option#18155
brijesh-elastic merged 3 commits into
elastic:mainfrom
brijesh-elastic:m365_defender-5.12.3

Conversation

@brijesh-elastic

@brijesh-elastic brijesh-elastic commented Mar 31, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

m365_defender: Introduce Include Alerts configuration option

This PR adds `Include Alerts` configuration option to to prevent ingestion stalls on large tenants. This
allows users to disable alert expansion in the Incident data stream, bypassing Microsoft Graph API
500 errors caused by high alert volume from single incident.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/m365_defender directory.
  • Run the following command to run tests.

elastic-package test -v

Related issues
@brijesh-elastic brijesh-elastic self-assigned this Mar 31, 2026
@brijesh-elastic
brijesh-elastic requested a review from a team as a code owner March 31, 2026 12:44
@brijesh-elastic brijesh-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:m365_defender Microsoft Defender XDR bugfix Pull request that fixes a bug issue Category: Integration quality Category: Quality used for SI planning Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Mar 31, 2026
@elasticmachine

elasticmachine commented Mar 31, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@github-actions

github-actions Bot commented Mar 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.
kcreddy
kcreddy reviewed Mar 31, 2026
View reviewed changes
Comment thread packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs
Comment on lines 57 to 59
split:
target: body.alerts
keep_parent: true

@kcreddy kcreddy Mar 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we also add a condition {{#if include_alerts}} here, to make it cleaner and explicit?

@brijesh-elastic brijesh-elastic Mar 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure
Comment thread packages/m365_defender/data_stream/incident/manifest.yml Outdated
required: true
show_user: true
title: Include Alerts
description: Include associated alerts with the incident. When enabled, the alerts are split so that each generated event represents a single alert from the incident.

@kcreddy kcreddy Mar 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also add If disabled, enable the Alerts (alerts_v2) data stream to ensure alert data is still collected.
@brijesh-elastic
brijesh-elastic requested a review from kcreddy March 31, 2026 15:03
@elasticmachine

elasticmachine commented Mar 31, 2026

Copy link
Copy Markdown

💚 Build Succeeded

cc @brijesh-elastic
kcreddy
kcreddy approved these changes Mar 31, 2026
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@brijesh-elastic
brijesh-elastic merged commit b4d6acd into elastic:main Mar 31, 2026
12 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Mar 31, 2026

Copy link
Copy Markdown
Contributor

Package m365_defender - 5.12.3 containing this change is available at https://epr.elastic.co/package/m365_defender/5.12.3/
@github-actions github-actions Bot mentioned this pull request Apr 8, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Category: Integration quality Category: Quality used for SI planning documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:m365_defender Microsoft Defender XDR Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@brijesh-elastic @elasticmachine @kcreddy