[m365_defender]: Support IdentityInfo events

[rkerr]

Integration Name

Microsoft M365 Defender [m365_defender]

Dataset Name

m365_defender.event

Integration Version

2.18.0

Agent Version

8.16.1

OS Version and Architecture

NA

User Goal

To be able to ingest the IdentityInfo event type as documented at https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-identityinfo-table.

Existing Features

The IdentitiyInfo event type is not listed as supported in the documentation, and ingesting it gives a not supported error.

What did you see?

error.message: The event category AdvancedHunting-IdentityInfo is not supported.

Anything else?

No response

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[jvalente-salemstate]

IdentityInfo is one of a handful of tables that the XDR event streaming API doesn't export to an event hub. The DeviceTvm* tables are other examples.

[rkerr]

I'm definitely seeing these events come through and getting an error.message: The event category AdvancedHunting-IdentityInfo is not supported.

It's interesting that doc lists some things as "Not Available" but doesn't list IdentityInfo at all - wondering if it might be a little out of date?

Alternatively this might be to do with how we ingest. I didn't set this up and the person that did is away for a few weeks. Our elastic instance is in azure and I know there's a native log forwarder for some types of azure logs that bypasses a lot of the APIs, but I didn't think it applied to the defender logs.

[jvalente-salemstate]

I'm definitely seeing these events come through and getting an error.message: The event category AdvancedHunting-IdentityInfo is not supported.

Checking our setup, this is case. The table wasn't available about a year ago but now I have 21/22 tables set to stream. IdentityInfo is the one not checked. Their documentation is definitely out of date.

Looking at the schema for the table, nearly all the parsing would be already in place . It just needs an additional condition for AdvancedHunting-IdentityInfo and couple fields to unique to the table.