[Internal]: Microsoft data in analyzer

[tomsonpl]

Description

Enable Analyzer to show process data coming from Microsoft Defender for Endpoint and M365 integrations

One change that happened with this PR is that we now enable fetching events of alert kind when used with 3rd party integrations, so user should have access to alerts-security.alerts-* indices in order to see these data properly in analyzer. We might want to adjust other docs regarding 3rd party data in analyzer accordingly.

Resources

PR: elastic/kibana#230742

Issue: https://github.com/elastic/security-team/issues/11591

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

None

What release is this request related to?

9.2

Serverless release

the week of 29th September 2025

Collaboration model

The documentation team

Point of contact.

Main contact: @tomsonpl

Stakeholders: @raqueltabuyo

[raqueltabuyo]

@natasha-moore-elastic I think there was already an issue as part of this 3rd party analyzer parent issue