[m365_defender] Enhance ECS Mappings and Refactor the Dashboards #16676

mohitjha-elastic · 2025-12-23T09:22:05Z

Proposed commit message

m365_defender: Enhance ECS mappings and refactor Defender dashboards.

This change enhances ECS mappings across all datasets to improve field consistency and alignment. 
The dashboard navigation has been updated to support the links panel widget and reorganized by event 
types rather than ingestion method. Visualization titles were cleaned up by removing redundant 
“[Logs Microsoft Defender XDR]” text where possible, and dashboard names were updated for 
better clarity. The Alert dashboard was refactored to improve usability, including the addition of a 
saved search visualization. Unused screenshots were removed, and existing integration screenshots 
were updated to reflect the latest dashboard changes.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/m365_defender directory.
Run the following command to run tests.

elastic-package test -v

Related Issues

Closes m365_defender: Dashboard improvements #16203

Screenshots

Logs-Microsoft-Defender-XDR-Alert-Elastic-12-23-2025_01_11_PM

Logs-Microsoft-Defender-XDR-App-Identity-Elastic-12-23-2025_01_10_PM

Logs-Microsoft-Defender-XDR-Device-Elastic-12-23-2025_01_10_PM

Logs-Microsoft-Defender-XDR-Vulnerability-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Incident-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Email-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Alert-Elastic-12-23-2025_01_08_PM

…m365_defender-extend-ecs

elastic-vault-github-plugin-prod · 2025-12-23T10:27:28Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-12-23T10:27:30Z

💚 Build Succeeded

Buildkite Build
Commit: 05c12ca

History

💔 Build #35827 failed d3a678b
💔 Build #35826 failed 9c5d644

cc @mohitjha-elastic

elasticmachine · 2025-12-23T10:33:13Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy · 2025-12-26T03:24:42Z

packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

+            append:
+              field: host.ip
+              tag: append_ip_interfaces_to_host_ip
+              value: '{{{_ingest._value}}}'
+              allow_duplicates: false


Can we use convert processor with on_failure instead of an append?

The field used to populate host.ip has already been converted to the IP type earlier; therefore, the append processor is used here.

kcreddy · 2025-12-26T03:37:32Z

packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

+      source: |
+        def processExecutable = new HashSet();
+        for (evidence in ctx.json.evidence) {
+          if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {


Suggested change

if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {

if (evidence?.image_file?.path != null && evidence.image_file.name != null) {

kcreddy · 2025-12-26T03:40:13Z

packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

+          if (!(ctx.process instanceof HashMap)) {
+            ctx.process = new HashMap();
+          }


Suggested change

if (!(ctx.process instanceof HashMap)) {

ctx.process = new HashMap();

}

ctx.process = ctx.process ?: [:];

kcreddy · 2025-12-26T03:51:49Z

packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

+            ctx.process = new HashMap();
+          }
+          def execList = new ArrayList(processExecutable);
+          Collections.sort(execList);


If this sorting was done, the it could remove the relationship with custom array fields, making it difficult to analyse. Is it required?

kcreddy · 2025-12-26T04:13:30Z

packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

          ignore_missing: true
+  - script:
+      description: Set process.executable from evidence image_file path and name.
+      tag: script_set_process_executable_from_image_file


There's existing script processors for process and parent process: https://github.com/elastic/integrations/blob/main/packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml#L2449
Can you utilise them instead of a new one?

kcreddy · 2025-12-26T04:15:14Z

packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml

        - m365_defender.incident.alert.service_source
        - m365_defender.incident.web_url
        - m365_defender.incident.assigned_to
-        - m365_defender.incident.alert.threat_family_name


Same for the alert data stream as well.

kcreddy · 2025-12-26T04:15:47Z

packages/m365_defender/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

+  - set:
+      field: '@timestamp'
+      tag: set_timestamp_from_last_seen_timestamp
+      copy_from: m365_defender.vulnerability.last_seen_timestamp
+      ignore_empty_value: true


This is full ingest, so no need to set timestamp to document time.

kcreddy · 2025-12-26T05:22:23Z

packages/m365_defender/img/m365_defender-alert-api.png

Update Severity Over Time to reflect severity labels (medium, low, high) instead of numbers.

Enhance ECS Mappings and refactor the dashboards.

9c5d644

mohitjha-elastic self-assigned this Dec 23, 2025

mohitjha-elastic added 3 commits December 23, 2025 14:54

Update changelog entry.

d3a678b

Merge branch 'main' of github.com:mohitjha-elastic/integrations into …

0389acb

…m365_defender-extend-ecs

Run system test

05c12ca

mohitjha-elastic marked this pull request as ready for review December 23, 2025 10:33

mohitjha-elastic requested a review from a team as a code owner December 23, 2025 10:33

kcreddy self-requested a review December 24, 2025 08:44

kcreddy reviewed Dec 26, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[m365_defender] Enhance ECS Mappings and Refactor the Dashboards #16676

[m365_defender] Enhance ECS Mappings and Refactor the Dashboards #16676

mohitjha-elastic commented Dec 23, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 23, 2025

Uh oh!

elasticmachine commented Dec 23, 2025

Uh oh!

elasticmachine commented Dec 23, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

mohitjha-elastic Jan 5, 2026

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

kcreddy Dec 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {
	if (evidence?.image_file?.path != null && evidence.image_file.name != null) {

[m365_defender] Enhance ECS Mappings and Refactor the Dashboards #16676

Are you sure you want to change the base?

[m365_defender] Enhance ECS Mappings and Refactor the Dashboards #16676

Conversation

mohitjha-elastic commented Dec 23, 2025

Proposed commit message

Checklist

How to test this PR locally

Related Issues

Screenshots

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 23, 2025

🚀 Benchmarks report

Uh oh!

elasticmachine commented Dec 23, 2025

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Dec 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants