Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #24829 to 7.12: [Filebeat] Update Oauth2 flow for m365 defender fileset #24850

Closed
wants to merge 2 commits into from
Closed

Cherry-pick #24829 to 7.12: [Filebeat] Update Oauth2 flow for m365 defender fileset #24850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d500faf
[Filebeat] Update Oauth2 flow for m365 defender fileset (#24829)
P1llus Mar 30, 2021
bda50e5
Update CHANGELOG.next.asciidoc
P1llus Mar 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Fix Cisco AMP `@metadata._id` calculation {issue}24717[24717] {pull}24718[24718]
- Fix date parsing in GSuite/login and Google Workspace/login filesets. {issue}24694[24694]
- Fix gcp/vpcflow module error where input type was defaulting to file. {pull}24719[24719]
- Updating Oauth2 flow for m365_defender fileset. {pull}24829[24829]

*Heartbeat*

Expand Down
8 changes: 7 additions & 1 deletion filebeat/docs/modules/microsoft.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,9 @@ Example config:
enabled: true
var.oauth2.client.id: "123abc-879546asd-349587-ad64508"
var.oauth2.client.secret: "980453~-Sg99gedf"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/v2.0/token"
var.oauth2.scopes:
- "https://api.security.microsoft.com/.default"
----

*`var.oauth2.client.id`*::
Expand All @@ -69,6 +71,10 @@ The secret related to the client ID.

A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL.

*`var.oauth2.scopes`*::

A list of included scopes, should use .default unless different is specified.

[float]
==== 365 Defender ECS fields

Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/filebeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1369,7 +1369,11 @@ filebeat.modules:
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/module/microsoft/_meta/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,11 @@
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down
8 changes: 7 additions & 1 deletion x-pack/filebeat/module/microsoft/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,9 @@ Example config:
enabled: true
var.oauth2.client.id: "123abc-879546asd-349587-ad64508"
var.oauth2.client.secret: "980453~-Sg99gedf"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/v2.0/token"
var.oauth2.scopes:
- "https://api.security.microsoft.com/.default"
----

*`var.oauth2.client.id`*::
Expand All @@ -64,6 +66,10 @@ The secret related to the client ID.

A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL.

*`var.oauth2.scopes`*::

A list of included scopes, should use .default unless different is specified.

[float]
==== 365 Defender ECS fields

Expand Down
2 changes: 0 additions & 2 deletions x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ config_version: "2"
interval: {{ .interval }}

auth.oauth2: {{ .oauth2 | tojson }}
auth.oauth2.provider: azure
auth.oauth2.azure.resource: https://api.securitycenter.windows.com/

request.url: "https://api.security.microsoft.com/api/incidents"
request.method: GET
Expand Down
6 changes: 5 additions & 1 deletion x-pack/filebeat/modules.d/microsoft.yml.disabled
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,11 @@
#var.oauth2.client.secret: ""

# Oauth Token URL, should include the tenant ID
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
#var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

# Related scopes, default should be included
#var.oauth2.scopes:
# - "https://api.security.microsoft.com/.default"
dhcp:
enabled: true

Expand Down