You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_batch_size"></a> [batch\_size](#input\_batch\_size)| Batch size for the response of the Alert Security Graph API V2. The maximum supported batch size value is 2000. |`number`|`2000`| no |
25
-
| <aname="input_client_id"></a> [client\_id](#input\_client\_id)|The client ID related to creating a new application on Azure. |`string`| n/a | yes |
26
-
| <aname="input_client_secret"></a> [client\_secret](#input\_client\_secret)|The secret related to the client ID. |`string`| n/a | yes |
25
+
| <aname="input_client_id"></a> [client\_id](#input\_client\_id)|Client ID for Azure AD application. |`string`| n/a | yes |
26
+
| <aname="input_client_secret"></a> [client\_secret](#input\_client\_secret)|Client Secret for Azure AD application. |`string`| n/a | yes |
27
27
| <aname="input_enable_request_tracer"></a> [enable\_request\_tracer](#input\_enable\_request\_tracer)| The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. |`bool`|`false`| no |
28
28
| <aname="input_fleet_agent_policy_id"></a> [fleet\_agent\_policy\_id](#input\_fleet\_agent\_policy\_id)| Agent policy ID to add the package policy to. |`string`| n/a | yes |
29
29
| <aname="input_fleet_data_stream_namespace"></a> [fleet\_data\_stream\_namespace](#input\_fleet\_data\_stream\_namespace)| Namespace to use for the data stream. |`string`|`"default"`| no |
30
30
| <aname="input_fleet_package_policy_description"></a> [fleet\_package\_policy\_description](#input\_fleet\_package\_policy\_description)| Description to use for the package policy. |`string`|`""`| no |
31
31
| <aname="input_fleet_package_policy_force"></a> [fleet\_package\_policy\_force](#input\_fleet\_package\_policy\_force)| Force reinstallation of the package even if already installed. When true, bypasses "already installed" checks and triggers complete re-installation. This deletes and recreates Kibana assets (dashboards, visualizations), removes transforms and their destination indices, and overwrites ingest pipelines and templates. |`bool`|`true`| no |
32
32
| <aname="input_fleet_package_policy_name_suffix"></a> [fleet\_package\_policy\_name\_suffix](#input\_fleet\_package\_policy\_name\_suffix)| Suffix to append to the end of the package policy name. |`string`|`""`| no |
33
-
| <aname="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version)| Version of the m365\_defender package to use. |`string`|`"5.7.0"`| no |
33
+
| <aname="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version)| Version of the m365\_defender package to use. |`string`|`"5.8.0"`| no |
34
34
| <aname="input_http_client_timeout"></a> [http\_client\_timeout](#input\_http\_client\_timeout)| Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. |`string`|`"30s"`| no |
35
35
| <aname="input_include_unknown_enum_members"></a> [include\_unknown\_enum\_members](#input\_include\_unknown\_enum\_members)| Return unknown members for properties of evolvable enum types. |`bool`|`null`| no |
36
36
| <aname="input_initial_interval"></a> [initial\_interval](#input\_initial\_interval)| How far back to pull the alerts from Microsoft Defender XDR. Supported units for this parameter are h/m/s. |`string`|`"24h"`| no |
37
37
| <aname="input_interval"></a> [interval](#input\_interval)| Duration between requests to the Microsoft Security Graph API V2. Supported units for this parameter are h/m/s. |`string`|`"5m"`| no |
38
-
| <aname="input_login_url"></a> [login\_url](#input\_login\_url)| URL of Login Server 'tenant-id and token endpoint added automatically'. |`string`|`"https://login.microsoftonline.com"`| no |
39
-
| <aname="input_oauth_endpoint_params_yaml"></a> [oauth\_endpoint\_params\_yaml](#input\_oauth\_endpoint\_params\_yaml)|Endpoint Params used for OAuth2 authentication as YAML. Refer to [documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-httpjson#_auth_oauth2_endpoint_params_2) for details. |`string`|`null`| no |
38
+
| <aname="input_login_url"></a> [login\_url](#input\_login\_url)|The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation. |`string`|`"https://login.microsoftonline.com"`| no |
39
+
| <aname="input_oauth_endpoint_params_yaml"></a> [oauth\_endpoint\_params\_yaml](#input\_oauth\_endpoint\_params\_yaml)|Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters. |`string`|`null`| no |
40
40
| <aname="input_preserve_duplicate_custom_fields"></a> [preserve\_duplicate\_custom\_fields](#input\_preserve\_duplicate\_custom\_fields)| Preserve m365\_defender.alert fields that were copied to Elastic Common Schema (ECS) fields. |`bool`|`false`| no |
41
41
| <aname="input_preserve_original_event"></a> [preserve\_original\_event](#input\_preserve\_original\_event)| Preserves a raw copy of the original event, added to the field `event.original`. |`bool`|`false`| no |
42
42
| <aname="input_processors_yaml"></a> [processors\_yaml](#input\_processors\_yaml)| Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. |`string`|`null`| no |
43
-
| <aname="input_proxy_url"></a> [proxy\_url](#input\_proxy\_url)| URL to proxy connections in the form of http\[s\]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format. |`string`|`null`| no |
43
+
| <aname="input_proxy_url"></a> [proxy\_url](#input\_proxy\_url)| URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format. |`string`|`null`| no |
44
44
| <aname="input_request_url"></a> [request\_url](#input\_request\_url)| URL of API endpoint. |`string`|`"https://graph.microsoft.com"`| no |
| <aname="input_tags"></a> [tags](#input\_tags)|n/a|`list(string)`| <pre>[<br> "forwarded",<br> "m365_defender-alert"<br>]</pre> | no |
47
-
| <aname="input_tenant_id"></a> [tenant\_id](#input\_tenant\_id)|The tenant ID related to creating a new application on Azure. |`string`| n/a | yes |
46
+
| <aname="input_tags"></a> [tags](#input\_tags)|Tags for the data-stream.|`list(string)`| <pre>[<br> "forwarded",<br> "m365_defender-alert"<br>]</pre> | no |
47
+
| <aname="input_tenant_id"></a> [tenant\_id](#input\_tenant\_id)|Tenant ID of the Azure. |`string`| n/a | yes |
48
48
| <aname="input_token_endpoint"></a> [token\_endpoint](#input\_token\_endpoint)| Microsoft supports multiple Oauth2 URL endpoints, the default is oauth2/v2.0/token, but can also be oauth2/token |`string`|`"oauth2/v2.0/token"`| no |
Copy file name to clipboardExpand all lines: fleet_integration/m365_defender.alert.httpjson/module.tf.json
+8-7Lines changed: 8 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -9,12 +9,12 @@
9
9
},
10
10
"client_id": {
11
11
"type": "string",
12
-
"description": "The client ID related to creating a new application on Azure.",
12
+
"description": "Client ID for Azure AD application.",
13
13
"nullable": false
14
14
},
15
15
"client_secret": {
16
16
"type": "string",
17
-
"description": "The secret related to the client ID.",
17
+
"description": "Client Secret for Azure AD application.",
18
18
"sensitive": true,
19
19
"nullable": false
20
20
},
@@ -50,7 +50,7 @@
50
50
"fleet_package_version": {
51
51
"type": "string",
52
52
"description": "Version of the m365_defender package to use.",
53
-
"default": "5.7.0"
53
+
"default": "5.8.0"
54
54
},
55
55
"http_client_timeout": {
56
56
"type": "string",
@@ -77,13 +77,13 @@
77
77
},
78
78
"login_url": {
79
79
"type": "string",
80
-
"description": "URL of Login Server 'tenant-id and token endpoint added automatically'.",
80
+
"description": "The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation.",
81
81
"default": "https://login.microsoftonline.com",
82
82
"nullable": false
83
83
},
84
84
"oauth_endpoint_params_yaml": {
85
85
"type": "string",
86
-
"description": "Endpoint Params used for OAuth2 authentication as YAML. Refer to [documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-httpjson#_auth_oauth2_endpoint_params_2) for details.",
86
+
"description": "Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters.",
87
87
"default": null
88
88
},
89
89
"preserve_duplicate_custom_fields": {
@@ -105,7 +105,7 @@
105
105
},
106
106
"proxy_url": {
107
107
"type": "string",
108
-
"description": "URL to proxy connections in the form of http\\[s\\]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.",
108
+
"description": "URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.",
109
109
"default": null
110
110
},
111
111
"request_url": {
@@ -121,6 +121,7 @@
121
121
},
122
122
"tags": {
123
123
"type": "list(string)",
124
+
"description": "Tags for the data-stream.",
124
125
"default": [
125
126
"forwarded",
126
127
"m365_defender-alert"
@@ -129,7 +130,7 @@
129
130
},
130
131
"tenant_id": {
131
132
"type": "string",
132
-
"description": "The tenant ID related to creating a new application on Azure.",
Copy file name to clipboardExpand all lines: fleet_integration/m365_defender.event.azure-eventhub/README.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,15 +29,15 @@ No resources.
29
29
| <aname="input_fleet_package_policy_description"></a> [fleet\_package\_policy\_description](#input\_fleet\_package\_policy\_description)| Description to use for the package policy. |`string`|`""`| no |
30
30
| <aname="input_fleet_package_policy_force"></a> [fleet\_package\_policy\_force](#input\_fleet\_package\_policy\_force)| Force reinstallation of the package even if already installed. When true, bypasses "already installed" checks and triggers complete re-installation. This deletes and recreates Kibana assets (dashboards, visualizations), removes transforms and their destination indices, and overwrites ingest pipelines and templates. |`bool`|`true`| no |
31
31
| <aname="input_fleet_package_policy_name_suffix"></a> [fleet\_package\_policy\_name\_suffix](#input\_fleet\_package\_policy\_name\_suffix)| Suffix to append to the end of the package policy name. |`string`|`""`| no |
32
-
| <aname="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version)| Version of the m365\_defender package to use. |`string`|`"5.7.0"`| no |
32
+
| <aname="input_fleet_package_version"></a> [fleet\_package\_version](#input\_fleet\_package\_version)| Version of the m365\_defender package to use. |`string`|`"5.8.0"`| no |
33
33
| <aname="input_preserve_duplicate_custom_fields"></a> [preserve\_duplicate\_custom\_fields](#input\_preserve\_duplicate\_custom\_fields)| Preserve m365\_defender.event fields that were copied to Elastic Common Schema (ECS) fields. |`bool`|`false`| no |
34
34
| <aname="input_preserve_original_event"></a> [preserve\_original\_event](#input\_preserve\_original\_event)| Preserves a raw copy of the original event, added to the field `event.original`. |`bool`|`false`| no |
35
35
| <aname="input_processors_yaml"></a> [processors\_yaml](#input\_processors\_yaml)| Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. |`string`|`null`| no |
36
36
| <aname="input_resource_manager_endpoint"></a> [resource\_manager\_endpoint](#input\_resource\_manager\_endpoint)| By default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. |`string`|`null`| no |
37
37
| <aname="input_storage_account"></a> [storage\_account](#input\_storage\_account)| The name of the storage account where the consumer group's state/offsets will be stored and updated. |`string`| n/a | yes |
38
38
| <aname="input_storage_account_container"></a> [storage\_account\_container](#input\_storage\_account\_container)| The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You MUST use a dedicated storage account container for each Azure log type. DO NOT REUSE the same container name for more than one Azure log type. See [Container Names](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names) for details on naming rules from Microsoft. The integration generates a default container name if not specified. |`string`|`null`| no |
39
39
| <aname="input_storage_account_key"></a> [storage\_account\_key](#input\_storage\_account\_key)| The storage account key, this key will be used to authorize access to data in your storage account. |`string`| n/a | yes |
40
-
| <aname="input_tags"></a> [tags](#input\_tags)|n/a|`list(string)`| <pre>[<br> "forwarded",<br> "m365_defender-event"<br>]</pre> | no |
40
+
| <aname="input_tags"></a> [tags](#input\_tags)|Tags for the data-stream.|`list(string)`| <pre>[<br> "forwarded",<br> "m365_defender-event"<br>]</pre> | no |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments