- Notifications
You must be signed in to change notification settings - Fork545
{microsoft_defender_endpoint, m365_defender}.vulnerability: New API implementation#15603
{microsoft_defender_endpoint, m365_defender}.vulnerability: New API implementation#15603efd6 merged 15 commits intoelastic:mainfrom
Conversation
elasticmachine commentedOct 9, 2025
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
...s/m365_defender/kibana/visualization/m365_defender-4f3a6702-9642-4392-9b34-ceb1447e09a7.jsonShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
packages/m365_defender/data_stream/vulnerability/agent/stream/cel.yml.hbs OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
packages/microsoft_defender_endpoint/_dev/deploy/docker/vulnerability-http-mock-config.yml OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
...endpoint/kibana/search/microsoft_defender_endpoint-89e2c263-f9c2-4f34-85d2-86b1d1b9106b.json OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
...t/kibana/visualization/microsoft_defender_endpoint-4f3a6702-9642-4392-9b34-ceb1447e09a7.jsonShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
packages/m365_defender/data_stream/vulnerability/agent/stream/cel.yml.hbs OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
packages/m365_defender/data_stream/vulnerability/agent/stream/cel.yml.hbs OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
packages/microsoft_defender_endpoint/data_stream/vulnerability/agent/stream/cel.yml.hbs OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
packages/m365_defender/data_stream/vulnerability/_dev/test/system/test-default-config.yml OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
...crosoft_defender_endpoint/data_stream/vulnerability/_dev/test/system/test-default-config.yml OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
elastic-vault-github-plugin-prodbot commentedOct 10, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
🚀 Benchmarks reportPackage |
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
machine | 3086.42 | 2392.34 | -694.08 (-22.49%) | 💔 |
To see the full report comment with/test benchmark fullreport
packages/m365_defender/data_stream/vulnerability/agent/stream/cel.yml.hbs OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
brijesh-elastic commentedOct 11, 2025
Since there is a change in the transform schema, the |
elasticmachine commentedOct 12, 2025
💚 Build Succeeded
History
cc@kcreddy |
7c2d2ef intoelastic:mainUh oh!
There was an error while loading.Please reload this page.
Package m365_defender - 5.0.0 containing this change is available athttps://epr.elastic.co/package/m365_defender/5.0.0/ |
Package microsoft_defender_endpoint - 4.0.0 containing this change is available athttps://epr.elastic.co/package/microsoft_defender_endpoint/4.0.0/ |
…plementation (elastic#15603)Existing CEL program uses 3 API endpoints to fetch vulnerabilitydata. Although we fetch more fields using this approach, it doesn't scale well and hence is unusable even for few hundred machines.This PR updates the vulnerability data stream with new SoftwareVulnerabilitiesExport API[1], which is recommended for larger workloads. While there are few data points missed in this new implementation[2], we maintain all the required fields for 3rd party vulnerability workflow[3].Other changes:- Updates microsoft_defender_endpoint min stack version to "8.19.3" as the permissions for the transform were actually applied in "8.19.3" version, and not in "8.19.2"[4].- Add dataset filter to all visualisations of vulnerability dashboards.[1]:https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities#2-export-software-vulnerabilities-assessment-via-files[2]:elastic#15521 (comment)[3]:https://docs.elastic.dev/security-solution/cloud-security/cdr/3p-dev-guide[4]:elastic/elasticsearch#132629
…plementation (elastic#15603)Existing CEL program uses 3 API endpoints to fetch vulnerabilitydata. Although we fetch more fields using this approach, it doesn't scale well and hence is unusable even for few hundred machines.This PR updates the vulnerability data stream with new SoftwareVulnerabilitiesExport API[1], which is recommended for larger workloads. While there are few data points missed in this new implementation[2], we maintain all the required fields for 3rd party vulnerability workflow[3].Other changes:- Updates microsoft_defender_endpoint min stack version to "8.19.3" as the permissions for the transform were actually applied in "8.19.3" version, and not in "8.19.2"[4].- Add dataset filter to all visualisations of vulnerability dashboards.[1]:https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities#2-export-software-vulnerabilities-assessment-via-files[2]:elastic#15521 (comment)[3]:https://docs.elastic.dev/security-solution/cloud-security/cdr/3p-dev-guide[4]:elastic/elasticsearch#132629
Uh oh!
There was an error while loading.Please reload this page.
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Pipeline tests and System tests pass.
Related issues
Screenshots
Updated dashboards:
Upgrade Flow
mde-vulnerability-3.1-to-3.2-upgrade-flow.mp4