[Meta] Module to ingest Office365 audit events

[adriansr]

• o365audit input (draft)
• persist state (needs [WIP] Filebeat input v2 #14229)
• module with filesets for different types (Azure, Exchange, Sharepoint..) ([SIEM] Office 365 module #16386)
• (tbd) mock server for integration tests
• Dashboards

Modules

For a metricset to go GA, the following criterias should be met:

• Supported versions are documented
• Supported operating systems are documented (if applicable)
• Integration tests exist
• System tests exist
• Automated checks that all fields are documented
• Documentation
• Fields follow ECS and naming conventions
• Dashboards exists (if applicable)
• Kibana Home Tutorial (if applicable)
  • Open PR against Kibana repo with tutorial. Examples can be found here.

Filebeat module

• Test log files exist for the grok patterns
• Generated output for at least 1 log file exists

Metricbeat module

• Example data.json exists and an automated way to generate it exists (go test -data)
• Test environment in Docker exist for integration tests

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[mbarretta]

All bits that flow from this issue need to support the configuration of alternative O365 endpoints: not all users are on the public cloud.

[adriansr]

@mbarretta I think that is supported in the current input draft, it allows to configure a custom authentication endpoint (default https://login.microsoftonline.com/) and custom "resource"/API endpoint (default https://manage.office.com), but I'd like it to have it validated before release.

[philippkahr]

I also wanted to point out that the Office365 audit logs do not contain any azure ad sign-in logs. For that, you need to talk either to a Microsoft Azure Event Hub, a storage pool, or the Microsoft logs monitor logs Microsoft Docs for Azure AD Log streaming.

I do not know if it would make sense to add this in this module or to move it to the Azure module. Just wanted to throw it in here :)