Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Update Oauth2 flow for m365 defender fileset #24829

Merged
merged 2 commits into from
Mar 30, 2021
Merged

[Filebeat] Update Oauth2 flow for m365 defender fileset #24829

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3432990
updating m365 config and documentation to match new Oauth2 authentica…
P1llus Mar 30, 2021
2c54da1
Update changelog
P1llus Mar 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -381,6 +381,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix date parsing in GSuite/login and Google Workspace/login filesets. {issue}24694[24694]
- Fix date parsing in GSuite/login fileset. {issue}24694[24694]
- Improve Cisco ASA/FTD parsing of messages - better support for identity FW messages. Change network.bytes, source.bytes, and destination.bytes to long from integer since value can exceed integer capacity. Add descriptions for various processors for easier pipeline editing in Kibana UI. {pull}23766[23766]
- Updating Oauth2 flow for m365_defender fileset. {pull}24829[24829]

*Heartbeat*

Expand Down
8 changes: 7 additions & 1 deletion filebeat/docs/modules/microsoft.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,9 @@ Example config:
enabled: true
var.oauth2.client.id: "123abc-879546asd-349587-ad64508"
var.oauth2.client.secret: "980453~-Sg99gedf"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/v2.0/token"
var.oauth2.scopes:
- "https://api.security.microsoft.com/.default"
----

*`var.oauth2.client.id`*::
Expand All @@ -69,6 +71,10 @@ The secret related to the client ID.

A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL.

*`var.oauth2.scopes`*::

A list of included scopes, should use .default unless different is specified.

[float]
==== 365 Defender ECS fields

Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/filebeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1369,7 +1369,11 @@ filebeat.modules:
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/module/microsoft/_meta/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,11 @@
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down
8 changes: 7 additions & 1 deletion x-pack/filebeat/module/microsoft/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,9 @@ Example config:
enabled: true
var.oauth2.client.id: "123abc-879546asd-349587-ad64508"
var.oauth2.client.secret: "980453~-Sg99gedf"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/v2.0/token"
var.oauth2.scopes:
- "https://api.security.microsoft.com/.default"
----

*`var.oauth2.client.id`*::
Expand All @@ -64,6 +66,10 @@ The secret related to the client ID.

A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL.

*`var.oauth2.scopes`*::

A list of included scopes, should use .default unless different is specified.

[float]
==== 365 Defender ECS fields

Expand Down
2 changes: 0 additions & 2 deletions x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ config_version: "2"
interval: {{ .interval }}

auth.oauth2: {{ .oauth2 | tojson }}
auth.oauth2.provider: azure
auth.oauth2.azure.resource: https://api.securitycenter.windows.com/

{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/modules.d/microsoft.yml.disabled
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,11 @@
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down