Skip to content

Conversation

@mohitjha-elastic
Copy link
Collaborator

Proposed commit message

m365_defender: Add benchmark and policy test for all data streams.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/m365_defender directory.
  • Run the following command to run tests.

elastic-package test -v

Related Issue

@mohitjha-elastic mohitjha-elastic self-assigned this Nov 4, 2025
@mohitjha-elastic mohitjha-elastic requested a review from a team as a code owner November 4, 2025 19:26
@mohitjha-elastic mohitjha-elastic added Integration:m365_defender Microsoft Defender XDR Category: Integration quality Category: Quality used for SI planning Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Nov 4, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Comment on lines 7 to 10
- name: status
cardinality: 100000
- name: severity
cardinality: 100000
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Try to get these fields close to real-value because cardinality impacts ES heap metrics.
Here, I think both status and severity cannot have such high cardinality I'm assuming?

Comment on lines 23 to 26
- name: status
cardinality: 100000
- name: severity
cardinality: 100000
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here.

Get the severity and status field closer to the real values.
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @mohitjha-elastic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Integration quality Category: Quality used for SI planning Integration:m365_defender Microsoft Defender XDR Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

m365_defender: Add policy tests

3 participants