[m365_defender] Enhance ECS Mappings and Refactor the Dashboards by mohitjha-elastic · Pull Request #16676 · elastic/integrations

mohitjha-elastic · 2025-12-23T09:22:05Z

Proposed commit message

m365_defender: Enhance ECS mappings and refactor Defender dashboards.

This change enhances ECS mappings across all datasets to improve field consistency and alignment. 
The dashboard navigation has been updated to support the links panel widget and reorganized by event 
types rather than ingestion method. Visualization titles were cleaned up by removing redundant 
“[Logs Microsoft Defender XDR]” text where possible, and dashboard names were updated for 
better clarity. The Alert dashboard was refactored to improve usability, including the addition of a 
saved search visualization. Unused screenshots were removed, and existing integration screenshots 
were updated to reflect the latest dashboard changes.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/m365_defender directory.
Run the following command to run tests.

elastic-package test -v

Related Issues

Closes m365_defender: Dashboard improvements #16203

Screenshots

Logs-Microsoft-Defender-XDR-App-Identity-Elastic-12-23-2025_01_10_PM

Logs-Microsoft-Defender-XDR-Device-Elastic-12-23-2025_01_10_PM

Logs-Microsoft-Defender-XDR-Vulnerability-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Incident-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Email-Elastic-12-23-2025_01_09_PM

Logs-Microsoft-Defender-XDR-Alert-Elastic-12-23-2025_01_08_PM

…m365_defender-extend-ecs

elastic-vault-github-plugin-prod · 2025-12-23T10:27:28Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-12-23T10:33:13Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy · 2025-12-26T03:37:32Z

+      source: |
+        def processExecutable = new HashSet();
+        for (evidence in ctx.json.evidence) {
+          if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {


Suggested change

if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {

if (evidence?.image_file?.path != null && evidence.image_file.name != null) {

kcreddy · 2025-12-26T04:13:30Z

          ignore_missing: true
+  - script:
+      description: Set process.executable from evidence image_file path and name.
+      tag: script_set_process_executable_from_image_file


There's existing script processors for process and parent process: https://github.com/elastic/integrations/blob/main/packages/m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml#L2449
Can you utilise them instead of a new one?

I felt there was limited reusable logic in that script, so I separated it to handle the process and parent process fields independently. While it could be merged into the existing script, doing so would make it longer and harder to understand. Keeping it separate improves readability and maintainability.

Can you add new script near this existing one? We can have most process fields logic in one place.

1. Update alert dashboard. 2. Remove custom duplicate fields of threat family in alert dataset. 3. Optimize the script to set process fields.

kcreddy · 2026-01-06T10:01:34Z

          ignore_missing: true
+  - script:
+      description: Set process.executable from evidence image_file path and name.
+      tag: script_set_process_executable_from_image_file


Can you add new script near this existing one? We can have most process fields logic in one place.

kcreddy · 2026-01-06T10:08:55Z

+        for (evidence in ctx.json.evidence) {
+          if (evidence?.parent_process?.image_file?.path != null && evidence.parent_process.image_file.name != null) {
+            String path = evidence.parent_process.image_file.path;
+            String name = evidence.parent_process.image_file.name;
+            String separator = path.contains("\\") ? "\\" : "/";
+            if (!path.endsWith(separator)) {
+              path = path + separator;
+            }
+            processParentExecutable.add(path + name);
+          } else if (evidence?.parent_process?.image_file?.name != null) {
+            processParentExecutable.add(evidence.parent_process.image_file.name);
+          }
+        }


This logic is same as above. Can we create a reusable function to improve maintainability?

elasticmachine · 2026-01-07T07:38:35Z

💚 Build Succeeded

Buildkite Build
Commit: 5008b68

History

💚 Build #36136 succeeded 3ebaa79
💚 Build #35828 succeeded 05c12ca
💔 Build #35827 failed d3a678b
💔 Build #35826 failed 9c5d644

cc @mohitjha-elastic

kcreddy

LGTM, thanks!

elastic-vault-github-plugin-prod · 2026-01-07T09:50:08Z

Package m365_defender - 5.5.0 containing this change is available at https://epr.elastic.co/package/m365_defender/5.5.0/

Enhance ECS Mappings and refactor the dashboards.

9c5d644

mohitjha-elastic self-assigned this Dec 23, 2025

mohitjha-elastic added 3 commits December 23, 2025 14:54

Update changelog entry.

d3a678b

Merge branch 'main' of github.com:mohitjha-elastic/integrations into …

0389acb

…m365_defender-extend-ecs

Run system test

05c12ca

mohitjha-elastic marked this pull request as ready for review December 23, 2025 10:33

mohitjha-elastic requested a review from a team as a code owner December 23, 2025 10:33

kcreddy self-requested a review December 24, 2025 08:44

kcreddy reviewed Dec 26, 2025

View reviewed changes

Resolve review comments.

3ebaa79

1. Update alert dashboard. 2. Remove custom duplicate fields of threat family in alert dataset. 3. Optimize the script to set process fields.

mohitjha-elastic requested a review from kcreddy January 6, 2026 07:30

kcreddy reviewed Jan 6, 2026

View reviewed changes

Merged script into one to set process fields.

5008b68

mohitjha-elastic requested a review from kcreddy January 7, 2026 07:10

kcreddy approved these changes Jan 7, 2026

View reviewed changes

mohitjha-elastic merged commit c44d59e into elastic:main Jan 7, 2026
8 checks passed

mohitjha-elastic deleted the m365_defender-extend-ecs branch January 7, 2026 09:14

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jan 8, 2026

	if (evidence?.image_file?.path != null && evidence?.image_file?.name != null) {
	if (evidence?.image_file?.path != null && evidence.image_file.name != null) {

Conversation

mohitjha-elastic commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related Issues

Screenshots

Uh oh!

elastic-vault-github-plugin-prod Bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

elasticmachine commented Dec 23, 2025

Uh oh!

Uh oh!

kcreddy Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kcreddy Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

mohitjha-elastic Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

kcreddy Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

kcreddy Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jan 7, 2026

💚 Build Succeeded

History

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mohitjha-elastic commented Dec 23, 2025 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Dec 23, 2025 •

edited

Loading