Microsoft Defender for Endpoint integration


Version	2.33.0 (View all)
Compatible Kibana version(s)	8.18.0 or higher 9.0.0 or higher
Supported Serverless project types What's this?	Security Observability
Subscription level What's this?	Basic
Level of support What's this?	Elastic

This integration is for Microsoft Defender for Endpoint logs.

Microsoft Defender for Endpoint integration collects data for Alert, Machine, and Machine Action logs using REST API.

Data streams

This integration collects the following logs:

Alert - Retrieves alerts generated by Microsoft Defender for Endpoint.
Machine - Retrieves machines that have communicated with Microsoft Defender for Endpoint.
Machine Action - Retrieves logs of actions carried out on machines.

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to Agentless integrations and the Agentless integrations FAQ.

Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

Agent Based Installation

Elastic Agent must be installed
You can install only one Elastic Agent per host.
Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.

Installing and managing an Elastic Agent:

You have a few options for installing and managing an Elastic Agent:

Install a Fleet-managed Elastic Agent (recommended):

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

Data stream	API Permissions
Alert	Alert.Read.All
Machine	Machine.Read.All
Machine Action	Machine.Read.All

After the application has been created, it should contain 3 values that you need to apply to the module configuration.

These values are:

Client ID
Client Secret
Tenant ID

Enabling the integration in Elastic:

In Kibana navigate to Management > Integrations.
In "Search for integrations" top bar, search for Microsoft Defender for Endpoint.
Select the "Microsoft Defender for Endpoint" integration from the search results.
Select "Add Microsoft Defender for Endpoint" to add the integration.
Add all the required integration configuration parameters, including the Client ID, Client Secret, Tenant ID to enable data collection.
Select "Save and continue" to save the integration.

ECS mappings

Defender for Endpoint fields	ECS Fields
alertCreationTime	@timestamp
aadTenantId	cloud.account.id
category	threat.technique.name
computerDnsName	host.hostname
description	rule.description
detectionSource	observer.name
evidence.fileName	file.name
evidence.filePath	file.path
evidence.processId	process.pid
evidence.processCommandLine	process.command_line
evidence.processCreationTime	process.start
evidence.parentProcessId	process.parent.pid
evidence.parentProcessCreationTime	process.parent.start
evidence.sha1	file.hash.sha1
evidence.sha256	file.hash.sha256
evidence.url	url.full
firstEventTime	event.start
id	event.id
lastEventTime	event.end
machineId	cloud.instance.id
title	message
severity	event.severity

		{
    "@timestamp": "2025-04-01T09:20:53.806Z",
    "agent": {
        "ephemeral_id": "57c2955e-3022-4c82-813b-eff4e3d6a79b",
        "id": "570010d2-ab7e-4d5b-882e-ed58b15778da",
        "name": "elastic-agent-88683",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "id": "123543-d66c-4c7e-9e30-40034eb7c6f3"
        },
        "instance": {
            "id": "c5a964f417c11f6277d5bf9489f0d"
        },
        "provider": "azure"
    },
    "data_stream": {
        "dataset": "microsoft_defender_endpoint.log",
        "namespace": "65879",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "570010d2-ab7e-4d5b-882e-ed58b15778da",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "action": "Malware",
        "agent_id_status": "verified",
        "category": [
            "host",
            "malware"
        ],
        "created": "2020-06-30T10:09:01.1569718Z",
        "dataset": "microsoft_defender_endpoint.log",
        "duration": 0,
        "end": "2020-06-30T10:07:44.333733Z",
        "id": "da637291085411733957_-1043898914",
        "ingested": "2025-04-01T09:20:56Z",
        "kind": "alert",
        "provider": "defender_endpoint",
        "severity": 2,
        "start": "2020-06-30T10:07:44.333733Z",
        "timezone": "UTC",
        "type": [
            "end"
        ]
    },
    "file": {
        "name": "SB.xsl",
        "path": "C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5"
    },
    "host": {
        "hostname": "testserver4",
        "id": "c5a964f417c11f6277d5bf9489f0d",
        "name": "testserver4"
    },
    "input": {
        "type": "log"
    },
    "log": {
        "file": {
            "path": "/tmp/service_logs/defender_atp-test.json.log"
        },
        "offset": 0
    },
    "message": "An active 'Exeselrun' malware was detected",
    "microsoft": {
        "defender_endpoint": {
            "assignedTo": "elastic@elasticuser.com",
            "evidence": {
                "entityType": "File"
            },
            "incidentId": "12",
            "investigationId": "9",
            "investigationState": "Benign",
            "lastUpdateTime": "2020-07-03T15:15:39.13Z",
            "resolvedTime": "2020-06-30T11:13:12.2680434Z",
            "status": "Resolved"
        }
    },
    "observer": {
        "name": "WindowsDefenderAv",
        "product": "Defender for Endpoint",
        "vendor": "Microsoft"
    },
    "related": {
        "hosts": [
            "testserver4"
        ]
    },
    "rule": {
        "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection."
    },
    "tags": [
        "microsoft-defender-endpoint",
        "forwarded"
    ],
    "threat": {
        "framework": "MITRE ATT&CK",
        "technique": {
            "name": [
                "Malware"
            ]
        }
    }
}

	

Field	Description	Type
@timestamp	Event timestamp.	date
cloud.image.id	Image ID for the cloud instance.	keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset	constant_keyword
event.module	Event module	constant_keyword
host.containerized	If the host is a container.	boolean
host.os.build	OS build information.	keyword
host.os.codename	OS codename, if any.	keyword
input.type	Input type	keyword
log.offset	Log offset	long
microsoft.defender_endpoint.assignedTo	Owner of the alert.	keyword
microsoft.defender_endpoint.classification	Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'.	keyword
microsoft.defender_endpoint.determination	Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'.	keyword
microsoft.defender_endpoint.evidence.aadUserId	ID of the user involved in the alert	keyword
microsoft.defender_endpoint.evidence.accountName	Username of the user involved in the alert	keyword
microsoft.defender_endpoint.evidence.domainName	Domain name related to the alert	keyword
microsoft.defender_endpoint.evidence.entityType	The type of evidence	keyword
microsoft.defender_endpoint.evidence.ipAddress	IP address involved in the alert	ip
microsoft.defender_endpoint.evidence.userPrincipalName	Principal name of the user involved in the alert	keyword
microsoft.defender_endpoint.incidentId	The Incident ID of the Alert.	keyword
microsoft.defender_endpoint.investigationId	The Investigation ID related to the Alert.	keyword
microsoft.defender_endpoint.investigationState	The current state of the Investigation.	keyword
microsoft.defender_endpoint.lastUpdateTime	The date and time (in UTC) the alert was last updated.	date
microsoft.defender_endpoint.rbacGroupName	User group related to the alert	keyword
microsoft.defender_endpoint.resolvedTime	The date and time in which the status of the alert was changed to 'Resolved'.	date
microsoft.defender_endpoint.status	Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.	keyword
microsoft.defender_endpoint.threatFamilyName	Threat family.	keyword

Machine

This is the machine dataset.

Example

		{
    "@timestamp": "2025-04-14T05:54:49.518Z",
    "agent": {
        "ephemeral_id": "a2b7ac2f-3e28-445c-afa4-539453b79a3a",
        "id": "33ea3bb6-a939-48aa-9632-9eae9a203137",
        "name": "elastic-agent-52008",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "microsoft_defender_endpoint.machine",
        "namespace": "77636",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "33ea3bb6-a939-48aa-9632-9eae9a203137",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "dataset": "microsoft_defender_endpoint.machine",
        "ingested": "2025-04-14T05:54:52Z",
        "kind": "event",
        "original": "{\"aadDeviceId\":null,\"agentVersion\":\"10.8760.17763.6414\",\"computerDnsName\":\"dlp-win2k19\",\"deviceValue\":\"Normal\",\"exclusionReason\":null,\"exposureLevel\":\"High\",\"firstSeen\":\"2024-10-17T13:56:23.9412922Z\",\"healthStatus\":\"Inactive\",\"id\":\"c114cb1c0b827fabcdefabcdef2b9cfd469c091b\",\"ipAddresses\":[{\"ipAddress\":\"10.50.11.140\",\"macAddress\":\"00005E005301\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"1.128.0.0\",\"macAddress\":\"00005E00530A\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"2a02:cf40::\",\"macAddress\":\"00005E005302\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"127.0.0.1\",\"macAddress\":null,\"operationalStatus\":\"Up\",\"type\":\"SoftwareLoopback\"},{\"ipAddress\":\"::1\",\"macAddress\":null,\"operationalStatus\":\"Up\",\"type\":\"SoftwareLoopback\"}],\"isAadJoined\":false,\"isExcluded\":false,\"isPotentialDuplication\":false,\"lastExternalIpAddress\":\"1.128.0.0\",\"lastIpAddress\":\"10.50.11.140\",\"lastSeen\":\"2024-10-24T06:12:35.4409708Z\",\"machineTags\":[],\"managedBy\":\"MicrosoftDefenderForEndpoint\",\"managedByStatus\":\"Success\",\"mergedIntoMachineId\":null,\"onboardingStatus\":\"Onboarded\",\"osArchitecture\":\"64-bit\",\"osBuild\":17763,\"osPlatform\":\"WindowsServer2019\",\"osProcessor\":\"x64\",\"osVersion\":null,\"rbacGroupId\":0,\"rbacGroupName\":null,\"riskScore\":\"None\",\"version\":\"1809\",\"vmMetadata\":null}",
        "type": [
            "info"
        ]
    },
    "group": {
        "id": "0"
    },
    "host": {
        "architecture": "x64",
        "hostname": "dlp-win2k19",
        "id": "c114cb1c0b827fabcdefabcdef2b9cfd469c091b",
        "ip": [
            "1.128.0.0"
        ],
        "name": "dlp-win2k19",
        "os": {
            "name": "WindowsServer2019 1809",
            "platform": "WindowsServer2019",
            "type": "windows",
            "version": "1809"
        },
        "risk": {
            "calculated_level": "None"
        }
    },
    "input": {
        "type": "cel"
    },
    "microsoft_defender_endpoint": {
        "machine": {
            "agent_version": "10.8760.17763.6414",
            "device_value": "Normal",
            "exposure_level": "High",
            "first_seen": "2024-10-17T13:56:23.941Z",
            "health_status": "Inactive",
            "ip_addresses": [
                {
                    "ip_address": "10.50.11.140",
                    "mac_address": "00-00-5E-00-53-01",
                    "operational_status": "Up",
                    "type": "Ethernet"
                },
                {
                    "ip_address": "1.128.0.0",
                    "mac_address": "00-00-5E-00-53-0A",
                    "operational_status": "Up",
                    "type": "Ethernet"
                },
                {
                    "ip_address": "2a02:cf40::",
                    "mac_address": "00-00-5E-00-53-02",
                    "operational_status": "Up",
                    "type": "Ethernet"
                },
                {
                    "ip_address": "127.0.0.1",
                    "operational_status": "Up",
                    "type": "SoftwareLoopback"
                },
                {
                    "ip_address": "::1",
                    "operational_status": "Up",
                    "type": "SoftwareLoopback"
                }
            ],
            "is_aad_joined": false,
            "is_excluded": false,
            "is_potential_duplication": false,
            "last_ip_address": "10.50.11.140",
            "last_seen": "2024-10-24T06:12:35.440Z",
            "managed_by": "MicrosoftDefenderForEndpoint",
            "managed_by_status": "Success",
            "onboarding_status": "Onboarded",
            "os_architecture": "64-bit",
            "os_build": 17763
        }
    },
    "observer": {
        "product": "Defender for Endpoint",
        "vendor": "Microsoft"
    },
    "related": {
        "hosts": [
            "dlp-win2k19",
            "c114cb1c0b827fabcdefabcdef2b9cfd469c091b"
        ],
        "ip": [
            "10.50.11.140",
            "1.128.0.0",
            "2a02:cf40::",
            "127.0.0.1",
            "::1"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "microsoft_defender_endpoint-machine"
    ]
}

	

Field	Description	Type
@timestamp	Event timestamp.	date
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset	constant_keyword
event.module	Event module	constant_keyword
input.type	Type of Filebeat input.	keyword
log.offset	Log offset.	long
microsoft_defender_endpoint.machine.aad_device_id	Microsoft Entra Device ID (when machine is Microsoft Entra joined).	keyword
microsoft_defender_endpoint.machine.agent_version		keyword
microsoft_defender_endpoint.machine.computer_dns_name	Machine fully qualified name.	keyword
microsoft_defender_endpoint.machine.device_value	The value of the device. Possible values are: Normal, Low, and High.	keyword
microsoft_defender_endpoint.machine.exposure_level	Exposure level as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Low, Medium, and High.	keyword
microsoft_defender_endpoint.machine.first_seen	First date and time where the machine was observed by Microsoft Defender for Endpoint.	date
microsoft_defender_endpoint.machine.health_status	machine health status. Possible values are: Active, Inactive, ImpairedCommunication, NoSensorData, NoSensorDataImpairedCommunication, and Unknown.	keyword
microsoft_defender_endpoint.machine.id	Machine identity.	keyword
microsoft_defender_endpoint.machine.ip_addresses.ip_address		ip
microsoft_defender_endpoint.machine.ip_addresses.mac_address		keyword
microsoft_defender_endpoint.machine.ip_addresses.operational_status		keyword
microsoft_defender_endpoint.machine.ip_addresses.type		keyword
microsoft_defender_endpoint.machine.is_aad_joined		boolean
microsoft_defender_endpoint.machine.is_excluded		boolean
microsoft_defender_endpoint.machine.is_potential_duplication		boolean
microsoft_defender_endpoint.machine.last_external_ip_address	Last IP through which the machine accessed the internet.	ip
microsoft_defender_endpoint.machine.last_ip_address	Last IP on local NIC on the machine.	ip
microsoft_defender_endpoint.machine.last_seen	Time and date of the last received full device report. A device typically sends a full report every 24 hours. NOTE: This property doesn't correspond to the last seen value in the UI. It pertains to the last device update.	date
microsoft_defender_endpoint.machine.machine_tags	Set of machine tags.	keyword
microsoft_defender_endpoint.machine.managed_by		keyword
microsoft_defender_endpoint.machine.managed_by_status		keyword
microsoft_defender_endpoint.machine.onboarding_status	Status of machine onboarding. Possible values are: onboarded, CanBeOnboarded, Unsupported, and InsufficientInfo.	keyword
microsoft_defender_endpoint.machine.os_architecture	Operating system architecture. Possible values are: 32-bit, 64-bit.	keyword
microsoft_defender_endpoint.machine.os_build	Operating system build number.	long
microsoft_defender_endpoint.machine.os_platform	Operating system platform.	keyword
microsoft_defender_endpoint.machine.os_processor	Operating system processor.	keyword
microsoft_defender_endpoint.machine.rbac_group_id	Machine group ID.	keyword
microsoft_defender_endpoint.machine.rbac_group_name	Machine group Name.	keyword
microsoft_defender_endpoint.machine.risk_score	Risk score as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Informational, Low, Medium, and High.	keyword
microsoft_defender_endpoint.machine.version	Operating system version.	keyword
microsoft_defender_endpoint.machine.vm_metadata.cloud_provider		keyword
microsoft_defender_endpoint.machine.vm_metadata.resource_id		keyword
microsoft_defender_endpoint.machine.vm_metadata.vm_id		keyword

Machine Action

This is the machine action dataset.

Example

		{
    "@timestamp": "2024-11-22T12:48:56.768Z",
    "agent": {
        "ephemeral_id": "75d3d06e-36f0-43c7-9dab-b94443c2b313",
        "id": "6901ad47-a8e1-47c7-ad4c-baaa28f4d6ba",
        "name": "elastic-agent-68004",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "microsoft_defender_endpoint.machine_action",
        "namespace": "90899",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6901ad47-a8e1-47c7-ad4c-baaa28f4d6ba",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "action": "RunAntiVirusScan",
        "agent_id_status": "verified",
        "created": "2024-11-22T12:48:33.993Z",
        "dataset": "microsoft_defender_endpoint.machine_action",
        "id": "d72456af-1234-5678-abcd-abcdef87fdee",
        "ingested": "2025-04-14T05:57:42Z",
        "kind": "event",
        "original": "{\"cancellationComment\":null,\"cancellationDateTimeUtc\":null,\"cancellationRequestor\":null,\"commands\":[],\"computerDnsName\":\"c-lab-24\",\"creationDateTimeUtc\":\"2024-11-22T12:48:33.9936591Z\",\"errorHResult\":0,\"externalId\":null,\"id\":\"d72456af-1234-5678-abcd-abcdef87fdee\",\"lastUpdateDateTimeUtc\":\"2024-11-22T12:48:56.7684808Z\",\"machineId\":\"de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8\",\"relatedFileInfo\":null,\"requestSource\":\"Portal\",\"requestor\":\"testuser@example.com\",\"requestorComment\":\"Quick Scan\",\"scope\":\"Quick\",\"status\":\"Succeeded\",\"title\":null,\"troubleshootInfo\":null,\"type\":\"RunAntiVirusScan\"}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "c-lab-24",
        "id": "de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8",
        "name": "c-lab-24"
    },
    "input": {
        "type": "cel"
    },
    "microsoft_defender_endpoint": {
        "machine_action": {
            "error_h_result": 0,
            "request_source": "Portal",
            "requestor_comment": "Quick Scan",
            "scope": "Quick",
            "status": "Succeeded",
            "type": "RunAntiVirusScan"
        }
    },
    "observer": {
        "product": "Defender for Endpoint",
        "vendor": "Microsoft"
    },
    "related": {
        "hosts": [
            "c-lab-24",
            "de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8"
        ],
        "user": [
            "testuser@example.com"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "microsoft_defender_endpoint-machine_action"
    ],
    "user": {
        "name": "testuser@example.com"
    }
}

	

Field	Description	Type
@timestamp	Event timestamp.	date
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset	constant_keyword
event.module	Event module	constant_keyword
input.type	Type of Filebeat input.	keyword
labels.is_transform_source	Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering.	constant_keyword
log.offset	Log offset.	long
microsoft_defender_endpoint.machine_action.cancellation_comment	Comment that was written when canceling the action.	keyword
microsoft_defender_endpoint.machine_action.cancellation_date_time_utc	The date and time when the action was canceled.	date
microsoft_defender_endpoint.machine_action.cancellation_requestor	Identity of the person that canceled the action.	keyword
microsoft_defender_endpoint.machine_action.commands	Commands to run. Allowed values are PutFile, RunScript, GetFile.	keyword
microsoft_defender_endpoint.machine_action.computer_dns_name	Name of the machine on which the action was executed.	keyword
microsoft_defender_endpoint.machine_action.creation_date_time_utc	The date and time when the action was created.	date
microsoft_defender_endpoint.machine_action.error_h_result		long
microsoft_defender_endpoint.machine_action.external_id	Id the customer can submit in the request for custom correlation.	keyword
microsoft_defender_endpoint.machine_action.id	Identity of the Machine Action entity.	keyword
microsoft_defender_endpoint.machine_action.last_update_date_time_utc	The last date and time when the action status was updated.	date
microsoft_defender_endpoint.machine_action.machine_id	ID of the machine on which the action was executed.	keyword
microsoft_defender_endpoint.machine_action.related_file_info.file_identifier	Contains two Properties. string fileIdentifier, Enum fileIdentifierType with the possible values: Sha1, Sha256, and Md5.	keyword
microsoft_defender_endpoint.machine_action.related_file_info.file_identifier_type	Enum fileIdentifierType with the possible values: Sha1, Sha256, and Md5.	keyword
microsoft_defender_endpoint.machine_action.request_source	The name of the user/application that submitted the action.	keyword
microsoft_defender_endpoint.machine_action.requestor	Identity of the person that executed the action.	keyword
microsoft_defender_endpoint.machine_action.requestor_comment	Comment that was written when issuing the action.	keyword
microsoft_defender_endpoint.machine_action.scope	Scope of the action. Full or Selective for Isolation, Quick or Full for antivirus scan.	keyword
microsoft_defender_endpoint.machine_action.status	Current status of the command. Possible values are: Pending, InProgress, Succeeded, Failed, TimeOut, and Cancelled.	keyword
microsoft_defender_endpoint.machine_action.title	Machine action title.	keyword
microsoft_defender_endpoint.machine_action.type	Type of the action. Possible values are: RunAntiVirusScan, Offboard, LiveResponse, CollectInvestigationPackage, Isolate, Unisolate, StopAndQuarantineFile, RestrictCodeExecution, and UnrestrictCodeExecution.	keyword

Changelog

Version	Details	Kibana version(s)
2.33.0	Enhancement (View pull request) Add machine and machine action data streams.	8.18.0 or higher 9.0.0 or higher
2.32.0	Enhancement (View pull request) Update `host.*` ECS mappings.	8.18.0 or higher 9.0.0 or higher
2.31.0	Enhancement (View pull request) Enable request trace log removal.	8.18.0 or higher 9.0.0 or higher
2.30.1	Bug fix (View pull request) Fix overview dashboard by removing reference to `event.integration`.	8.18.0 or higher 9.0.0 or higher
2.30.0	Enhancement (View pull request) Enable Agentless deployment.	8.18.0 or higher 9.0.0 or higher
2.29.0	Enhancement (View pull request) Add support for Kibana `9.0.0`	8.13.0 or higher 9.0.0 or higher
2.28.0	Enhancement (View pull request) Allow the usage of deprecated log input and support for stack 9.0	8.13.0 or higher
2.27.1	Bug fix (View pull request) Fix null reference for description field.	8.13.0 or higher
2.27.0	Enhancement (View pull request) Do not remove `event.original` in main ingest pipeline.	8.13.0 or higher
2.26.0	Enhancement (View pull request) Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".	8.13.0 or higher
2.25.1	Bug fix (View pull request) Use triple-brace Mustache templating when referencing variables in ingest pipelines.	8.13.0 or higher
2.25.0	Enhancement (View pull request) Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.	8.13.0 or higher
2.24.2	Bug fix (View pull request) Fix bug handling message field when events are received from Logstash with `ecs_compatibility` turned on.	8.12.0 or higher
2.24.1	Bug fix (View pull request) Fix handling of empty arrays.	8.12.0 or higher
2.24.0	Enhancement (View pull request) Set sensitive values as secret.	8.12.0 or higher
2.23.3	Bug fix (View pull request) Clean up null handling	8.7.1 or higher
2.23.2	Enhancement (View pull request) Changed owners	8.7.1 or higher
2.23.1	Bug fix (View pull request) Fix exclude_files pattern.	8.7.1 or higher
2.23.0	Enhancement (View pull request) Limit request tracer log count to five.	8.7.1 or higher
2.22.0	Enhancement (View pull request) ECS version updated to 8.11.0.	8.7.1 or higher
2.21.0	Enhancement (View pull request) Improve 'event.original' check to avoid errors if set.	8.7.1 or higher
2.20.0	Enhancement (View pull request) Update the package format_version to 3.0.0.	8.7.1 or higher
2.19.0	Enhancement (View pull request) Update package to ECS 8.10.0 and align ECS categorization fields.	8.7.1 or higher
2.18.0	Enhancement (View pull request) Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.	8.7.1 or higher
2.17.0	Enhancement (View pull request) Update package to ECS 8.9.0.	8.7.1 or higher
2.16.0	Enhancement (View pull request) Update package-spec to 2.9.0.	8.7.1 or higher
2.15.0	Enhancement (View pull request) Convert visualizations to lens.	8.7.1 or higher
2.14.0	Enhancement (View pull request) Document valid duration units.	8.7.1 or higher
2.13.0	Enhancement (View pull request) Ensure event.kind is correctly set for pipeline errors.	8.7.1 or higher
2.12.0	Enhancement (View pull request) Update package to ECS 8.8.0.	8.7.1 or higher
2.11.0	Enhancement (View pull request) Lowercase host.name field	8.7.1 or higher
2.10.0	Enhancement (View pull request) Add a new flag to enable request tracing	8.7.1 or higher
2.9.0	Enhancement (View pull request) Update package to ECS 8.7.0.	8.1.0 or higher
2.8.2	Enhancement (View pull request) Added categories and/or subcategories.	8.1.0 or higher
2.8.1	Bug fix (View pull request) Drop empty event sets.	8.1.0 or higher
2.8.0	Enhancement (View pull request) Adding support for Oauth2 scopes that is required for some users	8.1.0 or higher
2.7.0	Enhancement (View pull request) Update package to ECS 8.6.0.	8.1.0 or higher
2.6.0	Enhancement (View pull request) Adds support for newer Oauth Token URL	8.1.0 or higher
2.5.2	Enhancement (View pull request) Migrate the visualizations to by value in dashboards to minimize the saved object clutter and reduce time to load	8.1.0 or higher
2.5.1	Bug fix (View pull request) Remove duplicate fields.	7.14.1 or higher 8.0.0 or higher
2.5.0	Enhancement (View pull request) Update package to ECS 8.5.0.	7.14.1 or higher 8.0.0 or higher
2.4.0	Enhancement (View pull request) Update package to ECS 8.4.0	7.14.1 or higher 8.0.0 or higher
2.3.1	Bug fix (View pull request) Fix proxy URL documentation rendering.	7.14.1 or higher 8.0.0 or higher
2.3.0	Enhancement (View pull request) Update package to ECS 8.3.0.	7.14.1 or higher 8.0.0 or higher
2.2.1	Enhancement (View pull request) Update to Readme to include link to vendor documentation	7.14.1 or higher 8.0.0 or higher
2.2.0	Enhancement (View pull request) Update to ECS 8.2	7.14.1 or higher 8.0.0 or higher
2.1.0	Enhancement (View pull request) Add possibility to choose azure resource	7.14.1 or higher 8.0.0 or higher
2.0.1	Enhancement (View pull request) Add documentation for multi-fields	7.14.1 or higher 8.0.0 or higher
2.0.0	Enhancement (View pull request) Update to ECS 8.0	7.14.1 or higher 8.0.0 or higher
1.1.0	Enhancement (View pull request) Add 8.0.0 version constraint	7.14.1 or higher 8.0.0 or higher
1.0.2	Enhancement (View pull request) Update Title and Description.	7.14.1 or higher
1.0.1	Bug fix (View pull request) Fix logic that checks for the 'forwarded' tag	—
1.0.0	Enhancement (View pull request) First version	—

The Search AI Company

ELK Stack

Elastic Cloud

Generative AI

Search

Security

Observability

By solution

Industries

Customer spotlight

Research

Build

Learn

Connect

Microsoft Defender for Endpoint integration

Data streams

Requirements

Agentless Enabled Integration

Agent Based Installation

Installing and managing an Elastic Agent:

Install a Fleet-managed Elastic Agent (recommended):

Install Elastic Agent in standalone mode (advanced users):

Install Elastic Agent in a containerized environment:

Setup

To collect logs through REST API, follow the below steps:

Enabling the integration in Elastic:

ECS mappings

Logs Reference

Log

Example

Machine

Example

Machine Action

Example

Changelog