Skip to content

m365_defender: fix construction of file.path fields in the incident data stream #15728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

m365_defender: fix construction of file.path fields in the incident data stream #15728

wants to merge 1 commit into from

Conversation

@efd6
Copy link
Contributor

@efd6 efd6 commented Oct 22, 2025 •
edited
Loading

Proposed commit message

m365_defender: fix construction of file.path fields in the incident data stream

The ECS definition states that the file.path field should include the
file's basename as well as the directory.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this Oct 22, 2025
@efd6 efd6 added Integration:m365_defender Microsoft Defender XDR bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Oct 22, 2025
@efd6
m365_defender: fix construction of file.path fields in the incident d…
6d4a668 
…ata stream

The ECS defintions states that the file.path field should include the
file's basename as well as the directory.
@efd6 efd6 force-pushed the s6551-m365_defender branch from 0543ae5 to 6d4a668 Compare October 22, 2025 21:08
@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @efd6

@efd6 efd6 marked this pull request as ready for review October 22, 2025 21:44
@efd6 efd6 requested a review from a team as a code owner October 22, 2025 21:44
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

andrewkroh
andrewkroh reviewed Oct 22, 2025
View reviewed changes
packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml
append:
field: file.path
value: '{{{_ingest._value.file_details.path}}}'
value: '{{{_ingest._value.file_details.path}}}\{{{_ingest._value.file_details.name}}}'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we ever get events with fileDetails evidence from Microsoft Defender for Endpoint on {Linux,macOS,android,ios}? If so this might need a different path separator.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was wondering about that. I'm not sure how we can know this, or deal with it if we do.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@efd6 efd6

Labels

bugfix Pull request that fixes a bug issue Integration:m365_defender Microsoft Defender XDR Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@efd6 @elasticmachine @andrewkroh