Initial Interval Hardcored in Microsoft Fileset Configs

DumbBoi · January 14, 2025, 9:16pm

The initial intervals for microsoft defender atp and 365 defender are hard coded to last 5 and 55 minutes respectively. There doesn't seem to be any constraints in the API documentation. I plan on creating a PR to fix this.

Trevor_Blackford · February 19, 2025, 9:30pm

I don't think they are hardcoded, there's the default, but this is configurable

github.com/elastic/integrations

packages/m365_defender/data_stream/alert/manifest.yml

main

title: Collect Alert logs from Microsoft 365 Defender
type: logs
streams:
  - input: httpjson
    title: M365D Alerts
    description: Collect Alerts from M365 Defender.
    template_path: httpjson.yml.hbs
    vars:
      - name: request_url
        type: text
        title: Request URL
        description: URL of API endpoint.
        default: https://graph.microsoft.com
        multi: false
        required: true
        show_user: false
      - name: initial_interval
        type: text
        title: Initial Interval
        description: How far back to pull the alerts from Microsoft 365 Defender. Supported units for this parameter are h/m/s.

This file has been truncated. show original

Trevor_Blackford · February 27, 2025, 2:09am

Ah, I see this is for the modules, not the integrations. You are right, they are hardcoded - x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml
x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml

Trevor_Blackford · February 27, 2025, 2:12am

I also see your PR [Filebeat] Add Initial Interval for Microsoft Filesets by DumbBoi · Pull Request #42309 · elastic/beats · GitHub
I will make sure it gets reviewed. I would still strongly recommend using out integrations, which have better support, and are easier for users to maintain.

DumbBoi · April 17, 2025, 11:18am

apologies for being MIA. im only using it for testing for now and saw this bug. . I'll update the PR by tonight, hopefully it will get merged soon.

Topic		Replies	Views
Filebeat \|Microsoft Defender ATP module pull same events multiple times Beats filebeat	1	201	January 8, 2023
Error retrieving logs when using Defender ATP (under Microsoft Module) Beats beats-module , filebeat	1	340	June 15, 2021
Filebeat: Microsoft Module seems to be acquiring the same events for a period of time Beats filebeat	1	336	February 9, 2022
Microsoft Filebeat Module - Lack of ECS utilization Beats ecs-elastic-common-schema , filebeat	7	454	October 25, 2022
MISP Module Polling Interval Beats elastic-stack-security , beats-module , filebeat	10	1056	March 6, 2020

Initial Interval Hardcored in Microsoft Fileset Configs

Related topics