Microsoft Defender for Endpoint integration
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Generally available
Serverless Security
Generally available
Stack
9.1+
Generally available since 9.1
| Version | 4.15.0 (View all) |
| Managed integration release status | GA |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Elastic |
| Ingestion method(s) | API, File |
| Minimum Kibana version(s) | 9.1.2 8.19.3 |
Important - Managed integrations on Elastic Cloud Hosted
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.5
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.
This integration is for Microsoft Defender for Endpoint logs.
Microsoft Defender for Endpoint integration collects data for Alert, Baseline, Configuration, Information Gathering, Machine, Machine Action and Vulnerability logs using REST API.
For a demo, refer to the following video (click to view).
This integration collects the following logs:
- Alert - Retrieves alerts generated by Microsoft Defender for Endpoint.
- Baseline - Retrieves security baseline compliance assessment snapshots per device, profile, and configuration.
- Configuration - Retrieves secure configuration assessment snapshots per device from the SecureConfigurationsAssessmentByMachine API.
- Information Gathering - Retrieves per-device TVM information gathering posture snapshots (AV health, emerging threat mitigations, and attack surface telemetry) via the InfoGatheringExport API.
- Machine - Retrieves machines that have communicated with Microsoft Defender for Endpoint.
- Machine Action - Retrieves logs of actions carried out on machines.
- Vulnerability - Retrieves vulnerability change events (new, updated, and fixed) using the delta API.
Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.
For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.
Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.
To allow the integration to ingest data from the Microsoft Defender API, you need to create a new application on your Azure domain. The procedure to create an application is found on the Create a new Azure Application documentation page.
When the application is granted the API permissions listed in the table below, it will receive only the necessary access to collect logs nothing more within the Azure domain.
| Data stream | API Permissions |
|---|---|
| Alert | Alert.Read.All |
| Baseline | SecurityBaselinesAssessment.Read.All |
| Configuration | Vulnerability.Read.All, Vulnerability.Read |
| Information Gathering | Vulnerability.Read.All, Vulnerability.Read |
| Machine | Machine.Read.All |
| Machine Action | Machine.Read.All |
| Vulnerability | Vulnerability.Read.All, Vulnerability.Read |
After the application has been created, it should contain 3 values that you need to apply to the module configuration.
These values are:
- Client ID
- Client Secret
- Tenant ID
- In Kibana navigate to Management > Integrations.
- In the search bar, type Microsoft Defender for Endpoint.
- Select the Microsoft Defender for Endpoint integration and add it.
- Add all the required integration configuration parameters, including the Client ID, Client Secret, Tenant ID to enable data collection.
- Select "Save and continue" to save the integration.
The vulnerability data stream collects vulnerability change events from the SoftwareVulnerabilityChangesByMachine delta API, resuming from a saved sinceTime cursor. Every change to a vulnerability on a machine is a new document, so the source stream grows with change volume rather than with the size of the estate, and the latest_cdr_vuln transform maintains the current state of each vulnerability. The other data streams collect incrementally and follow the default lifecycle for their destination indices.
The package bounds the growth of these source data streams with a retention that depends on the deployment type:
| Data stream | Self-managed and Elastic Cloud Hosted (ILM policy) | Serverless (data stream lifecycle) |
|---|---|---|
logs-microsoft_defender_endpoint.vulnerability-* |
logs-microsoft_defender_endpoint.vulnerability-default_policy: roll over after 7d, delete 7d after rollover |
delete 7d after rollover |
On self-managed and Elastic Cloud Hosted deployments the ILM policy applies. The data stream lifecycle shipped with the package is not used there. ILM counts the delete age from the rollover of a backing index, so a document can remain for up to the rollover age plus the delete age. On Serverless, ILM is not available and the data stream lifecycle applies instead. It also works per backing index: Elasticsearch rolls the write index over automatically on age, size, or document count, and deletes a backing index once the retention has passed since it rolled over. A document therefore stays for the retention plus up to one rollover interval. The rollover age is derived from the retention and is an implementation detail that Elasticsearch may change. Where the package installs a transform, the transform's destination indices are not affected by either.
To keep data for a different period:
- Self-managed and Elastic Cloud Hosted: edit the ILM policy in Kibana under Stack Management → Index Lifecycle Policies, or with
PUT _ilm/policy/<policy name>. A package upgrade reinstalls the package's ILM policies, so check your change after upgrading. - Serverless: set the retention on the data stream, for example
PUT _data_stream/logs-microsoft_defender_endpoint.vulnerability-default/_lifecyclewith the body{"data_retention": "90d"}. Replacedefaultwith your namespace.
Note
The user or service account associated with the integration must have the following index privileges on the relevant index: delete, delete_index
| Defender for Endpoint fields | ECS Fields |
|---|---|
| alertCreationTime | @timestamp |
| aadTenantId | cloud.account.id |
| category | threat.technique.name |
| computerDnsName | host.hostname |
| description | rule.description |
| detectionSource | observer.name |
| evidence.fileName | file.name |
| evidence.filePath | file.path |
| evidence.processId | process.pid |
| evidence.processCommandLine | process.command_line |
| evidence.processCreationTime | process.start |
| evidence.parentProcessId | process.parent.pid |
| evidence.parentProcessCreationTime | process.parent.start |
| evidence.sha1 | file.hash.sha1 |
| evidence.sha256 | file.hash.sha256 |
| evidence.url | url.full |
| firstEventTime | event.start |
| id | event.id |
| lastEventTime | event.end |
| machineId | cloud.instance.id |
| title | message |
| severity | event.severity |
The values used in event.severity are consistent with Elastic Detection Rules.
| Severity Name | event.severity |
|---|---|
| Low (or Informational) | 21 |
| Medium | 47 |
| High | 73 |
| Critical | 99 |
The vulnerability data stream uses Microsoft Defender for Endpoint's delta API, which returns change events including remediated (Fixed) vulnerabilities. Each record carries a vulnerability.status field with one of the following values: open, fixed, or unknown.
Until the Kibana Vulnerability Findings page adds a default filter on this field, remediated vulnerabilities will appear alongside open findings. To exclude them, add the following filter to the Findings page or any saved search:
NOT vulnerability.status: fixed
This is equivalent to showing only currently active vulnerabilities.
This is the log dataset.
Example
{
"@timestamp": "2025-10-16T10:42:06.592Z",
"agent": {
"ephemeral_id": "b43b835d-ba25-4ad7-aa9f-200c15733e48",
"id": "353e6432-27a9-40a4-98a2-557dbb69496b",
"name": "elastic-agent-48674",
"type": "filebeat",
"version": "8.19.3"
},
"cloud": {
"account": {
"id": "a839b112-1253-6432-9bf6-94542403f21c"
},
"instance": {
"id": "111e6dd8c833c8a052ea231ec1b19adaf497b625"
},
"provider": "azure"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.log",
"namespace": "90146",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "353e6432-27a9-40a4-98a2-557dbb69496b",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"action": "Execution",
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2021-01-26T20:33:57.7220239Z",
"dataset": "microsoft_defender_endpoint.log",
"duration": 101466100,
"end": "2021-01-26T20:31:33.0577322Z",
"id": "da637472900382838869_1364969609",
"ingested": "2025-10-16T10:42:09Z",
"kind": "alert",
"provider": "defender_endpoint",
"severity": 21,
"start": "2021-01-26T20:31:32.9562661Z",
"timezone": "UTC",
"type": [
"access",
"start"
]
},
"host": {
"hostname": "temp123.middleeast.corp.microsoft.com",
"id": "111e6dd8c833c8a052ea231ec1b19adaf497b625",
"name": "temp123.middleeast.corp.microsoft.com"
},
"input": {
"type": "httpjson"
},
"message": "Low-reputation arbitrary code executed by signed executable",
"microsoft": {
"defender_endpoint": {
"assignedTo": "elastic@elasticuser.com",
"evidence": {
"aadUserId": "11118379-2a59-1111-ac3c-a51eb4a3c627",
"accountName": "name",
"domainName": "DOMAIN",
"entityType": "User",
"userPrincipalName": "temp123@microsoft.com"
},
"incidentId": "1126093",
"investigationState": "Queued",
"lastUpdateTime": "2021-01-26T20:33:59.2Z",
"rbacGroupName": "A",
"status": "New"
}
},
"observer": {
"name": "WindowsDefenderAtp",
"product": "Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"temp123.middleeast.corp.microsoft.com"
],
"user": [
"temp123"
]
},
"rule": {
"description": "Binaries signed by Microsoft can be used to run low-reputation arbitrary code. This technique hides the execution of malicious code within a trusted process. As a result, the trusted process might exhibit suspicious behaviors, such as opening a listening port or connecting to a command-and-control (C&C) server."
},
"tags": [
"microsoft-defender-endpoint",
"forwarded"
],
"threat": {
"framework": "MITRE ATT&CK",
"technique": {
"name": [
"Execution"
]
}
},
"user": {
"domain": "DOMAIN",
"id": "S-1-5-21-11111607-1111760036-109187956-75141",
"name": "temp123"
}
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| cloud.image.id | Image ID for the cloud instance. | keyword |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset | constant_keyword |
| event.module | Event module | constant_keyword |
| host.containerized | If the host is a container. | boolean |
| host.os.build | OS build information. | keyword |
| host.os.codename | OS codename, if any. | keyword |
| input.type | Input type | keyword |
| log.offset | Log offset | long |
| microsoft.defender_endpoint.assignedTo | Owner of the alert. | keyword |
| microsoft.defender_endpoint.classification | Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. | keyword |
| microsoft.defender_endpoint.determination | Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'. | keyword |
| microsoft.defender_endpoint.evidence.aadUserId | ID of the user involved in the alert | keyword |
| microsoft.defender_endpoint.evidence.accountName | Username of the user involved in the alert | keyword |
| microsoft.defender_endpoint.evidence.domainName | Domain name related to the alert | keyword |
| microsoft.defender_endpoint.evidence.entityType | The type of evidence | keyword |
| microsoft.defender_endpoint.evidence.ipAddress | IP address involved in the alert | ip |
| microsoft.defender_endpoint.evidence.userPrincipalName | Principal name of the user involved in the alert | keyword |
| microsoft.defender_endpoint.incidentId | The Incident ID of the Alert. | keyword |
| microsoft.defender_endpoint.investigationId | The Investigation ID related to the Alert. | keyword |
| microsoft.defender_endpoint.investigationState | The current state of the Investigation. | keyword |
| microsoft.defender_endpoint.lastUpdateTime | The date and time (in UTC) the alert was last updated. | date |
| microsoft.defender_endpoint.rbacGroupName | User group related to the alert | keyword |
| microsoft.defender_endpoint.resolvedTime | The date and time in which the status of the alert was changed to 'Resolved'. | date |
| microsoft.defender_endpoint.status | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. | keyword |
| microsoft.defender_endpoint.threatFamilyName | Threat family. | keyword |
This is the machine dataset.
Example
{
"@timestamp": "2025-10-16T10:43:46.052Z",
"agent": {
"ephemeral_id": "c45e3532-8231-4823-b919-99eedb3d39d8",
"id": "d09beef9-81e5-4ec1-b71e-6e744709b60f",
"name": "elastic-agent-38879",
"type": "filebeat",
"version": "8.19.3"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.machine",
"namespace": "77808",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "d09beef9-81e5-4ec1-b71e-6e744709b60f",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"agent_id_status": "verified",
"category": [
"host"
],
"dataset": "microsoft_defender_endpoint.machine",
"ingested": "2025-10-16T10:43:49Z",
"kind": "event",
"original": "{\"aadDeviceId\":null,\"agentVersion\":\"10.8760.17763.6414\",\"computerDnsName\":\"dlp-win2k19\",\"deviceValue\":\"Normal\",\"exclusionReason\":null,\"exposureLevel\":\"High\",\"firstSeen\":\"2024-10-17T13:56:23.9412922Z\",\"healthStatus\":\"Inactive\",\"id\":\"c114cb1c0b827fabcdefabcdef2b9cfd469c091b\",\"ipAddresses\":[{\"ipAddress\":\"10.50.11.140\",\"macAddress\":\"00005E005301\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"1.128.0.0\",\"macAddress\":\"00005E00530A\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"2a02:cf40::\",\"macAddress\":\"00005E005302\",\"operationalStatus\":\"Up\",\"type\":\"Ethernet\"},{\"ipAddress\":\"127.0.0.1\",\"macAddress\":null,\"operationalStatus\":\"Up\",\"type\":\"SoftwareLoopback\"},{\"ipAddress\":\"::1\",\"macAddress\":null,\"operationalStatus\":\"Up\",\"type\":\"SoftwareLoopback\"}],\"isAadJoined\":false,\"isExcluded\":false,\"isPotentialDuplication\":false,\"lastExternalIpAddress\":\"1.128.0.0\",\"lastIpAddress\":\"10.50.11.140\",\"lastSeen\":\"2024-10-24T06:12:35.4409708Z\",\"machineTags\":[],\"managedBy\":\"MicrosoftDefenderForEndpoint\",\"managedByStatus\":\"Success\",\"mergedIntoMachineId\":null,\"onboardingStatus\":\"Onboarded\",\"osArchitecture\":\"64-bit\",\"osBuild\":17763,\"osPlatform\":\"WindowsServer2019\",\"osProcessor\":\"x64\",\"osVersion\":null,\"rbacGroupId\":0,\"rbacGroupName\":null,\"riskScore\":\"None\",\"version\":\"1809\",\"vmMetadata\":null}",
"type": [
"info"
]
},
"group": {
"id": "0"
},
"host": {
"architecture": "x64",
"hostname": "dlp-win2k19",
"id": "c114cb1c0b827fabcdefabcdef2b9cfd469c091b",
"ip": [
"1.128.0.0"
],
"name": "dlp-win2k19",
"os": {
"name": "WindowsServer2019 1809",
"platform": "WindowsServer2019",
"type": "windows",
"version": "1809"
},
"risk": {
"calculated_level": "None"
}
},
"input": {
"type": "cel"
},
"microsoft_defender_endpoint": {
"machine": {
"agent_version": "10.8760.17763.6414",
"device_value": "Normal",
"exposure_level": "High",
"first_seen": "2024-10-17T13:56:23.941Z",
"health_status": "Inactive",
"ip_addresses": [
{
"ip_address": "10.50.11.140",
"mac_address": "00-00-5E-00-53-01",
"operational_status": "Up",
"type": "Ethernet"
},
{
"ip_address": "1.128.0.0",
"mac_address": "00-00-5E-00-53-0A",
"operational_status": "Up",
"type": "Ethernet"
},
{
"ip_address": "2a02:cf40::",
"mac_address": "00-00-5E-00-53-02",
"operational_status": "Up",
"type": "Ethernet"
},
{
"ip_address": "127.0.0.1",
"operational_status": "Up",
"type": "SoftwareLoopback"
},
{
"ip_address": "::1",
"operational_status": "Up",
"type": "SoftwareLoopback"
}
],
"is_aad_joined": false,
"is_excluded": false,
"is_potential_duplication": false,
"last_ip_address": "10.50.11.140",
"last_seen": "2024-10-24T06:12:35.440Z",
"managed_by": "MicrosoftDefenderForEndpoint",
"managed_by_status": "Success",
"onboarding_status": "Onboarded",
"os_architecture": "64-bit",
"os_build": 17763
}
},
"observer": {
"product": "Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"dlp-win2k19",
"c114cb1c0b827fabcdefabcdef2b9cfd469c091b"
],
"ip": [
"10.50.11.140",
"1.128.0.0",
"2a02:cf40::",
"127.0.0.1",
"::1"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"microsoft_defender_endpoint-machine"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset | constant_keyword |
| event.module | Event module | constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| log.offset | Log offset. | long |
| microsoft_defender_endpoint.machine.aad_device_id | Microsoft Entra Device ID (when machine is Microsoft Entra joined). | keyword |
| microsoft_defender_endpoint.machine.agent_version | keyword | |
| microsoft_defender_endpoint.machine.computer_dns_name | Machine fully qualified name. | keyword |
| microsoft_defender_endpoint.machine.device_value | The value of the device. Possible values are: Normal, Low, and High. | keyword |
| microsoft_defender_endpoint.machine.exposure_level | Exposure level as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Low, Medium, and High. | keyword |
| microsoft_defender_endpoint.machine.first_seen | First date and time where the machine was observed by Microsoft Defender for Endpoint. | date |
| microsoft_defender_endpoint.machine.health_status | machine health status. Possible values are: Active, Inactive, ImpairedCommunication, NoSensorData, NoSensorDataImpairedCommunication, and Unknown. | keyword |
| microsoft_defender_endpoint.machine.id | Machine identity. | keyword |
| microsoft_defender_endpoint.machine.ip_addresses.ip_address | ip | |
| microsoft_defender_endpoint.machine.ip_addresses.mac_address | keyword | |
| microsoft_defender_endpoint.machine.ip_addresses.operational_status | keyword | |
| microsoft_defender_endpoint.machine.ip_addresses.type | keyword | |
| microsoft_defender_endpoint.machine.is_aad_joined | boolean | |
| microsoft_defender_endpoint.machine.is_excluded | boolean | |
| microsoft_defender_endpoint.machine.is_potential_duplication | boolean | |
| microsoft_defender_endpoint.machine.last_external_ip_address | Last IP through which the machine accessed the internet. | ip |
| microsoft_defender_endpoint.machine.last_ip_address | Last IP on local NIC on the machine. | ip |
| microsoft_defender_endpoint.machine.last_seen | Time and date of the last received full device report. A device typically sends a full report every 24 hours. NOTE: This property doesn't correspond to the last seen value in the UI. It pertains to the last device update. | date |
| microsoft_defender_endpoint.machine.machine_tags | Set of machine tags. | keyword |
| microsoft_defender_endpoint.machine.managed_by | keyword | |
| microsoft_defender_endpoint.machine.managed_by_status | keyword | |
| microsoft_defender_endpoint.machine.onboarding_status | Status of machine onboarding. Possible values are: onboarded, CanBeOnboarded, Unsupported, and InsufficientInfo. | keyword |
| microsoft_defender_endpoint.machine.os_architecture | Operating system architecture. Possible values are: 32-bit, 64-bit. | keyword |
| microsoft_defender_endpoint.machine.os_build | Operating system build number. | long |
| microsoft_defender_endpoint.machine.os_platform | Operating system platform. | keyword |
| microsoft_defender_endpoint.machine.os_processor | Operating system processor. | keyword |
| microsoft_defender_endpoint.machine.rbac_group_id | Machine group ID. | keyword |
| microsoft_defender_endpoint.machine.rbac_group_name | Machine group Name. | keyword |
| microsoft_defender_endpoint.machine.risk_score | Risk score as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Informational, Low, Medium, and High. | keyword |
| microsoft_defender_endpoint.machine.version | Operating system version. | keyword |
| microsoft_defender_endpoint.machine.vm_metadata.cloud_provider | keyword | |
| microsoft_defender_endpoint.machine.vm_metadata.resource_id | keyword | |
| microsoft_defender_endpoint.machine.vm_metadata.vm_id | keyword |
This is the machine action dataset.
Example
{
"@timestamp": "2024-11-22T12:48:56.768Z",
"agent": {
"ephemeral_id": "2f48d0ac-be9d-40b4-90c7-221a29dbd6f5",
"id": "7a528879-f9cb-4500-8ca9-61cdde8b4c76",
"name": "elastic-agent-92539",
"type": "filebeat",
"version": "8.19.3"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.machine_action",
"namespace": "37546",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "7a528879-f9cb-4500-8ca9-61cdde8b4c76",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"action": "RunAntiVirusScan",
"agent_id_status": "verified",
"created": "2024-11-22T12:48:33.993Z",
"dataset": "microsoft_defender_endpoint.machine_action",
"id": "d72456af-1234-5678-abcd-abcdef87fdee",
"ingested": "2025-10-16T10:45:30Z",
"kind": "event",
"original": "{\"cancellationComment\":null,\"cancellationDateTimeUtc\":null,\"cancellationRequestor\":null,\"commands\":[],\"computerDnsName\":\"c-lab-24\",\"creationDateTimeUtc\":\"2024-11-22T12:48:33.9936591Z\",\"errorHResult\":0,\"externalId\":null,\"id\":\"d72456af-1234-5678-abcd-abcdef87fdee\",\"lastUpdateDateTimeUtc\":\"2024-11-22T12:48:56.7684808Z\",\"machineId\":\"de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8\",\"relatedFileInfo\":null,\"requestSource\":\"Portal\",\"requestor\":\"testuser@example.com\",\"requestorComment\":\"Quick Scan\",\"scope\":\"Quick\",\"status\":\"Succeeded\",\"title\":null,\"troubleshootInfo\":null,\"type\":\"RunAntiVirusScan\"}",
"outcome": "success",
"type": [
"info"
]
},
"host": {
"hostname": "c-lab-24",
"id": "de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8",
"name": "c-lab-24"
},
"input": {
"type": "cel"
},
"microsoft_defender_endpoint": {
"machine_action": {
"error_h_result": 0,
"request_source": "Portal",
"requestor_comment": "Quick Scan",
"scope": "Quick",
"status": "Succeeded",
"type": "RunAntiVirusScan"
}
},
"observer": {
"product": "Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"c-lab-24",
"de693d7fbdabcdefabcdefcfc9cf40b5bf2da1d8"
],
"user": [
"testuser",
"testuser@example.com"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"microsoft_defender_endpoint-machine_action"
],
"user": {
"domain": "example.com",
"email": "testuser@example.com",
"name": "testuser"
}
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset | constant_keyword |
| event.module | Event module | constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword |
| log.offset | Log offset. | long |
| microsoft_defender_endpoint.machine_action.cancellation_comment | Comment that was written when canceling the action. | keyword |
| microsoft_defender_endpoint.machine_action.cancellation_date_time_utc | The date and time when the action was canceled. | date |
| microsoft_defender_endpoint.machine_action.cancellation_requestor | Identity of the person that canceled the action. | keyword |
| microsoft_defender_endpoint.machine_action.commands | Commands to run. Allowed values are PutFile, RunScript, GetFile. | keyword |
| microsoft_defender_endpoint.machine_action.computer_dns_name | Name of the machine on which the action was executed. | keyword |
| microsoft_defender_endpoint.machine_action.creation_date_time_utc | The date and time when the action was created. | date |
| microsoft_defender_endpoint.machine_action.error_h_result | long | |
| microsoft_defender_endpoint.machine_action.external_id | Id the customer can submit in the request for custom correlation. | keyword |
| microsoft_defender_endpoint.machine_action.id | Identity of the Machine Action entity. | keyword |
| microsoft_defender_endpoint.machine_action.last_update_date_time_utc | The last date and time when the action status was updated. | date |
| microsoft_defender_endpoint.machine_action.machine_id | ID of the machine on which the action was executed. | keyword |
| microsoft_defender_endpoint.machine_action.related_file_info.file_identifier | Contains two Properties. string fileIdentifier, Enum fileIdentifierType with the possible values: Sha1, Sha256, and Md5. | keyword |
| microsoft_defender_endpoint.machine_action.related_file_info.file_identifier_type | Enum fileIdentifierType with the possible values: Sha1, Sha256, and Md5. | keyword |
| microsoft_defender_endpoint.machine_action.request_source | The name of the user/application that submitted the action. | keyword |
| microsoft_defender_endpoint.machine_action.requestor | Identity of the person that executed the action. | keyword |
| microsoft_defender_endpoint.machine_action.requestor_comment | Comment that was written when issuing the action. | keyword |
| microsoft_defender_endpoint.machine_action.scope | Scope of the action. Full or Selective for Isolation, Quick or Full for antivirus scan. | keyword |
| microsoft_defender_endpoint.machine_action.status | Current status of the command. Possible values are: Pending, InProgress, Succeeded, Failed, TimeOut, and Cancelled. | keyword |
| microsoft_defender_endpoint.machine_action.title | Machine action title. | keyword |
| microsoft_defender_endpoint.machine_action.type | Type of the action. Possible values are: RunAntiVirusScan, Offboard, LiveResponse, CollectInvestigationPackage, Isolate, Unisolate, StopAndQuarantineFile, RestrictCodeExecution, and UnrestrictCodeExecution. | keyword |
This is the vulnerability dataset.
Example
{
"@timestamp": "2026-05-20T12:00:00.000Z",
"ecs": {
"version": "8.17.0"
},
"event": {
"category": [
"vulnerability"
],
"id": "1212121212121212121212_red_hat_kernel_0:5.14.0-427.42.1.el9_4_CVE-2022-49226",
"kind": "event",
"original": "{\"id\":\"1212121212121212121212_red_hat_kernel_0:5.14.0-427.42.1.el9_4_CVE-2022-49226\",\"deviceId\":\"1212121212121212121212\",\"rbacGroupName\":\"Unassigned\",\"deviceName\":\"sample-host-1\",\"osPlatform\":\"Linux\",\"osVersion\":\"enterprise_linux_9.4\",\"osArchitecture\":\"x64\",\"softwareVendor\":\"red_hat\",\"softwareName\":\"kernel\",\"softwareVersion\":\"0:5.14.0-427.42.1.el9_4\",\"cveId\":\"CVE-2022-49226\",\"vulnerabilitySeverityLevel\":\"Medium\",\"recommendedSecurityUpdate\":\"CVE-2022-49226_oval:com.redhat.rhsa:def:20249315\",\"recommendedSecurityUpdateId\":\"RHSA-2024:9315\",\"recommendedSecurityUpdateUrl\":null,\"diskPaths\":[],\"registryPaths\":[],\"lastSeenTimestamp\":\"2026-05-20 22:45:00\",\"firstSeenTimestamp\":\"2026-05-20 10:43:58\",\"exploitabilityLevel\":\"NoExploit\",\"recommendationReference\":\"va-_-red_hat-_-kernel\",\"status\":\"New\",\"eventTimestamp\":\"2026-05-20 12:00:00\",\"cvssScore\":5.5,\"rbacGroupId\":0,\"isOnboarded\":true}",
"type": [
"info"
]
},
"group": {
"id": "0",
"name": "Unassigned"
},
"host": {
"architecture": "x64",
"hostname": "sample-host-1",
"id": "1212121212121212121212",
"name": "sample-host-1",
"os": {
"name": "Linux enterprise_linux_9.4",
"platform": "Linux",
"type": "linux",
"version": "enterprise_linux_9.4"
}
},
"microsoft_defender_endpoint": {
"vulnerability": {
"cve_id": "CVE-2022-49226",
"cvss_score": 5.5,
"device_id": "1212121212121212121212",
"device_name": "sample-host-1",
"event_timestamp": "2026-05-20T12:00:00.000Z",
"exploitability_level": "NoExploit",
"first_seen_timestamp": "2026-05-20T10:43:58.000Z",
"id": "1212121212121212121212_red_hat_kernel_0:5.14.0-427.42.1.el9_4_CVE-2022-49226",
"is_onboarded": true,
"last_seen_timestamp": "2026-05-20T22:45:00.000Z",
"os_architecture": "x64",
"os_platform": "Linux",
"os_version": "enterprise_linux_9.4",
"rbac_group_id": "0",
"rbac_group_name": "Unassigned",
"recommendation_reference": "va-_-red_hat-_-kernel",
"recommended_security_update": "CVE-2022-49226_oval:com.redhat.rhsa:def:20249315",
"recommended_security_update_id": "RHSA-2024:9315",
"severity_level": "Medium",
"software_name": "kernel",
"software_vendor": "red_hat",
"software_version": "0:5.14.0-427.42.1.el9_4",
"status": "New"
}
},
"observer": {
"product": "Microsoft Defender for Endpoint",
"vendor": "Microsoft"
},
"package": {
"name": "kernel",
"version": "0:5.14.0-427.42.1.el9_4"
},
"related": {
"hosts": [
"1212121212121212121212",
"sample-host-1"
]
},
"resource": {
"id": "1212121212121212121212",
"name": "sample-host-1"
},
"tags": [
"forwarded",
"microsoft_defender_endpoint-vulnerability"
],
"vulnerability": {
"classification": "CVSS",
"cve": "CVE-2022-49226",
"enumeration": "CVE",
"id": "CVE-2022-49226",
"reference": "https://www.cve.org/CVERecord?id=CVE-2022-49226",
"scanner": {
"vendor": "Microsoft"
},
"score": {
"base": 5.5
},
"severity": "Medium",
"status": "open",
"title": "Vulnerability found in kernel 0:5.14.0-427.42.1.el9_4 - CVE-2022-49226"
}
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| log.file.device_id | Device Id of the log file this event came from. | keyword |
| log.file.inode | Inode number of the log file. | keyword |
| log.offset | Log offset. | long |
| microsoft_defender_endpoint.vulnerability.cve_batch_title | keyword | |
| microsoft_defender_endpoint.vulnerability.cve_batch_url | keyword | |
| microsoft_defender_endpoint.vulnerability.cve_id | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system. | keyword |
| microsoft_defender_endpoint.vulnerability.cvss_score | The CVSS score of the CVE. | float |
| microsoft_defender_endpoint.vulnerability.device_id | Unique identifier for the device in the service. | keyword |
| microsoft_defender_endpoint.vulnerability.device_name | Fully qualified domain name (FQDN) of the device. | keyword |
| microsoft_defender_endpoint.vulnerability.disk_paths | Disk evidence that the product is installed on the device. | keyword |
| microsoft_defender_endpoint.vulnerability.event_timestamp | The time this delta event was found. | date |
| microsoft_defender_endpoint.vulnerability.exploitability_level | The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit) | keyword |
| microsoft_defender_endpoint.vulnerability.first_seen_timestamp | First time this product CVE was seen on the device. | date |
| microsoft_defender_endpoint.vulnerability.id | Unique identifier for the record. | keyword |
| microsoft_defender_endpoint.vulnerability.is_onboarded | boolean | |
| microsoft_defender_endpoint.vulnerability.last_seen_timestamp | Last time the software was reported on the device. | date |
| microsoft_defender_endpoint.vulnerability.os_architecture | Architecture of the operating system running on the device. | keyword |
| microsoft_defender_endpoint.vulnerability.os_platform | Platform of the operating system running on the device. | keyword |
| microsoft_defender_endpoint.vulnerability.os_version | Version of the operating system running on the device. | keyword |
| microsoft_defender_endpoint.vulnerability.rbac_group_id | keyword | |
| microsoft_defender_endpoint.vulnerability.rbac_group_name | The role-based access control (RBAC) group. | keyword |
| microsoft_defender_endpoint.vulnerability.recommendation_reference | A reference to the recommendation ID related to this software. | keyword |
| microsoft_defender_endpoint.vulnerability.recommended_security_update | Name or description of the security update provided by the software vendor to address the vulnerability. | keyword |
| microsoft_defender_endpoint.vulnerability.recommended_security_update_id | Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles. | keyword |
| microsoft_defender_endpoint.vulnerability.registry_paths | Registry evidence that the product is installed in the device. | keyword |
| microsoft_defender_endpoint.vulnerability.severity_level | Severity level assigned to the security vulnerability based on the CVSS score. | keyword |
| microsoft_defender_endpoint.vulnerability.software_name | Name of the software product. | keyword |
| microsoft_defender_endpoint.vulnerability.software_vendor | Name of the software vendor. | keyword |
| microsoft_defender_endpoint.vulnerability.software_version | Version number of the software product. | keyword |
| microsoft_defender_endpoint.vulnerability.status | Delta event status indicating whether the vulnerability is New, Fixed, or Updated. | keyword |
| observer.vendor | Vendor name of the observer. | constant_keyword |
| package.fixed_version | keyword | |
| package.name | Package name | keyword |
| package.version | Package version | keyword |
| resource.id | keyword | |
| resource.name | keyword | |
| vulnerability.cve | The CVE id of the vulnerability. | keyword |
| vulnerability.published_date | date | |
| vulnerability.scanner.vendor | The name of the vulnerability scanner vendor. | constant_keyword |
| vulnerability.status | Lifecycle state of the vulnerability finding on the asset. Expected values: open, fixed, reopened, unknown. | keyword |
| vulnerability.title | keyword |
This is the configuration dataset.
Example
{
"@timestamp": "2021-01-11T09:47:58.854Z",
"agent": {
"ephemeral_id": "71f8999a-aade-42de-b010-77e2fc0d9d46",
"id": "3a23980c-e8c1-454d-acfc-91dfba80ae0d",
"name": "elastic-agent-64172",
"type": "filebeat",
"version": "8.19.3"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.configuration",
"namespace": "79074",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "3a23980c-e8c1-454d-acfc-91dfba80ae0d",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"agent_id_status": "verified",
"category": [
"configuration"
],
"dataset": "microsoft_defender_endpoint.configuration",
"ingested": "2026-08-19T05:13:25Z",
"kind": "event",
"original": "{\"configurationCategory\":\"Network\",\"configurationId\":\"scid-10000\",\"configurationImpact\":5,\"configurationName\":\"Disable insecure administration protocol - Telnet\",\"configurationSubcategory\":\"\",\"deviceId\":\"00013ee62c6b12345b10214e1801b217b50ab455c293d\",\"deviceName\":\"srv-dc01.contoso.example\",\"isApplicable\":true,\"isCompliant\":true,\"isExpectedUserImpact\":false,\"osPlatform\":\"WindowsServer2019\",\"osVersion\":\"10.0.17763.2330\",\"rbacGroupName\":\"Production-Servers\",\"recommendationReference\":\"sca-_-scid-10000\",\"timestamp\":\"2021-01-11T09:47:58.854Z\"}",
"type": [
"info"
]
},
"group": {
"name": "Production-Servers"
},
"host": {
"id": "00013ee62c6b12345b10214e1801b217b50ab455c293d",
"name": "srv-dc01.contoso.example",
"os": {
"platform": [
"WindowsServer2019"
],
"type": "windows",
"version": "10.0.17763.2330"
}
},
"input": {
"type": "cel"
},
"microsoft_defender_endpoint": {
"configuration": {
"configuration_category": "Network",
"configuration_impact": 5,
"is_applicable": true,
"is_compliant": true,
"is_expected_user_impact": false,
"os_platform": "WindowsServer2019",
"recommendation_reference": "sca-_-scid-10000"
}
},
"observer": {
"product": "Microsoft Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"00013ee62c6b12345b10214e1801b217b50ab455c293d",
"srv-dc01.contoso.example"
]
},
"rule": {
"id": "scid-10000",
"name": "Disable insecure administration protocol - Telnet"
},
"tags": [
"preserve_original_event",
"forwarded",
"microsoft_defender_endpoint-configuration"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| microsoft_defender_endpoint.configuration.configuration_category | Category or grouping to which the configuration belongs, such as Application, OS, Network, Accounts, or Security controls. | keyword |
| microsoft_defender_endpoint.configuration.configuration_impact | Rated impact of the configuration to the overall configuration score (1-10). | long |
| microsoft_defender_endpoint.configuration.configuration_subcategory | Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | keyword |
| microsoft_defender_endpoint.configuration.is_applicable | Indicates whether the configuration or policy is applicable. | boolean |
| microsoft_defender_endpoint.configuration.is_compliant | Indicates whether the configuration or policy is properly configured. | boolean |
| microsoft_defender_endpoint.configuration.is_expected_user_impact | Indicates whether there will be user impact if the configuration will be applied. | boolean |
| microsoft_defender_endpoint.configuration.os_platform | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 11. | keyword |
| microsoft_defender_endpoint.configuration.recommendation_reference | A reference to the recommendation ID related to this software. | keyword |
| observer.product | The product name of the observer. | constant_keyword |
| observer.vendor | Vendor name of the observer. | constant_keyword |
This is the baseline dataset.
Example
{
"@timestamp": "2026-08-10T09:00:00.000Z",
"agent": {
"ephemeral_id": "91bafbb8-3521-4967-a893-63946eb7c761",
"id": "d7a57e16-e520-4dba-99a4-4decc5c74036",
"name": "elastic-agent-91187",
"type": "filebeat",
"version": "8.19.3"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.baseline",
"namespace": "48895",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "d7a57e16-e520-4dba-99a4-4decc5c74036",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"agent_id_status": "verified",
"category": [
"configuration"
],
"created": "2026-08-10T08:15:02.478Z",
"dataset": "microsoft_defender_endpoint.baseline",
"id": "a1b2c3d4e5f6789012345678901234567890abcd_9e1b90be-e83e-485b-a5ec-4a429412e734_1.1.1",
"ingested": "2026-08-19T05:14:54Z",
"kind": "event",
"original": "{\"complianceCalculationTimeOffset\":\"2026-08-10T09:00:00.000Z\",\"configurationId\":\"1.1.1\",\"currentValue\":[\"24\"],\"dataCollectionTimeOffset\":\"2026-08-10T08:15:02.478Z\",\"deviceId\":\"a1b2c3d4e5f6789012345678901234567890abcd\",\"deviceName\":\"srv-dc01.contoso.example\",\"id\":\"a1b2c3d4e5f6789012345678901234567890abcd_9e1b90be-e83e-485b-a5ec-4a429412e734_1.1.1\",\"isApplicable\":true,\"isCompliant\":false,\"osPlatform\":\"WindowsServer2019\",\"osVersion\":\"10.0.17763.2330\",\"profileId\":\"9e1b90be-e83e-485b-a5ec-4a429412e734\",\"rbacGroupId\":86,\"rbacGroupName\":\"Production-Servers\",\"recommendedValue\":[\"Greater than or equal '24'\"],\"source\":[\"password_hist_len\"]}",
"type": [
"info"
]
},
"group": {
"id": "86",
"name": "Production-Servers"
},
"host": {
"id": "a1b2c3d4e5f6789012345678901234567890abcd",
"name": "srv-dc01.contoso.example",
"os": {
"name": "WindowsServer2019 10.0.17763.2330",
"platform": "WindowsServer2019",
"type": "windows",
"version": "10.0.17763.2330"
}
},
"input": {
"type": "cel"
},
"microsoft_defender_endpoint": {
"baseline": {
"current_value": [
"24"
],
"is_applicable": true,
"is_compliant": false,
"profile_id": "9e1b90be-e83e-485b-a5ec-4a429412e734",
"recommended_value": [
"Greater than or equal '24'"
],
"source": [
"password_hist_len"
]
}
},
"observer": {
"product": "Microsoft Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"a1b2c3d4e5f6789012345678901234567890abcd",
"srv-dc01.contoso.example"
]
},
"rule": {
"id": "1.1.1"
},
"tags": [
"preserve_original_event",
"forwarded",
"microsoft_defender_endpoint-baseline"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| microsoft_defender_endpoint.baseline.current_value | Set of detected values found on the device. | keyword |
| microsoft_defender_endpoint.baseline.is_applicable | Indicates whether the configuration is applicable to this device. | boolean |
| microsoft_defender_endpoint.baseline.is_compliant | Indicates whether the device is compliant with the configuration. | boolean |
| microsoft_defender_endpoint.baseline.profile_id | Unique identifier for the profile assessed. | keyword |
| microsoft_defender_endpoint.baseline.recommended_value | Set of expected values for the current device setting to be compliant. | keyword |
| microsoft_defender_endpoint.baseline.source | The registry path or other location used to determine the current device setting. | keyword |
| observer.product | The product name of the observer. | constant_keyword |
| observer.vendor | Vendor name of the observer. | constant_keyword |
This is the information_gathering dataset.
Example
{
"@timestamp": "2026-08-31T20:30:00.000Z",
"agent": {
"ephemeral_id": "dcd6b968-f904-445c-a308-9e2ac7ce4249",
"id": "0b06fe13-6909-42e1-9cff-8789dc326148",
"name": "elastic-agent-27567",
"type": "filebeat",
"version": "8.19.3"
},
"data_stream": {
"dataset": "microsoft_defender_endpoint.information_gathering",
"namespace": "41200",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "0b06fe13-6909-42e1-9cff-8789dc326148",
"snapshot": false,
"version": "8.19.3"
},
"event": {
"agent_id_status": "verified",
"category": [
"host",
"configuration"
],
"dataset": "microsoft_defender_endpoint.information_gathering",
"ingested": "2026-09-07T07:10:32Z",
"kind": "event",
"original": "{\"DeviceGatheredInfo\":\"{\\\"AvMode\\\":null,\\\"Log4j_CVE_2021_44228\\\":null}\",\"DeviceId\":\"cccccccccccccccccccccccccccccccccccccccc\",\"DeviceName\":\"sample-host-3\",\"LastSeenTime\":\"2026-08-31 18:45:00\",\"OsPlatform\":\"Linux\",\"OsVersion\":\"enterprise_linux_9.4\",\"RbacGroupId\":42,\"RbacGroupName\":\"Production-Servers\",\"Timestamp\":\"2026-08-31 20:30:00\"}",
"type": [
"info"
]
},
"group": {
"name": "Production-Servers"
},
"host": {
"id": "cccccccccccccccccccccccccccccccccccccccc",
"name": "sample-host-3",
"os": {
"full": "Linux enterprise_linux_9.4",
"name": "Linux",
"platform": "linux",
"type": "linux",
"version": "enterprise_linux_9.4"
}
},
"input": {
"type": "cel"
},
"microsoft_defender_endpoint": {
"information_gathering": {
"last_seen": "2026-08-31T18:45:00.000Z",
"os_platform": "Linux",
"rbac_group_id": "42"
}
},
"observer": {
"product": "Microsoft Defender for Endpoint",
"vendor": "Microsoft"
},
"related": {
"hosts": [
"cccccccccccccccccccccccccccccccccccccccc",
"sample-host-3"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"microsoft_defender_endpoint-information_gathering"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| input.type | Type of Filebeat input. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_engine_publish_time | Datetime when the antivirus engine version was published. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_engine_ring | Update ring of the antivirus engine. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_engine_update_time | Datetime when the antivirus engine was last updated on the device. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_engine_version | Antivirus engine version. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_is_engine_up_to_date | Up-to-date status of the antivirus engine. | boolean |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_is_platform_up_to_date | Up-to-date status of the antivirus platform. | boolean |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_is_signature_up_to_date | Up-to-date status of the antivirus signature. | boolean |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_mode | Antivirus mode as a string-typed integer value ranging from 0 to 5. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_mode_data_refresh_time | Datetime when the antivirus mode data was last refreshed. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_platform_expiration_time | Datetime when the antivirus platform version expires. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_platform_publish_time | Datetime when the antivirus platform version was published. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_platform_ring | Update ring of the antivirus platform. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_platform_update_time | Datetime when the antivirus platform was last updated on the device. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_platform_version | Antivirus platform version. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_scan_results | Antivirus scan results reported by the device. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_signature_data_refresh_time | Datetime when the antivirus signature data was last refreshed. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_signature_publish_time | Datetime when the antivirus security intelligence build was released. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_signature_ring | Update ring of the antivirus signatures. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_signature_update_time | Datetime when the antivirus security intelligence was last updated on the device. | date |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.av_signature_version | Antivirus security intelligence version. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.bootiful_mind_status | Bootiful Mind scan status. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.cloud_protection_state | Cloud-delivered protection state of the antivirus. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.ebpf_status | Indicates whether the eBPF-based sensor is enabled on Linux endpoints. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.full_scan_result | Full scan result of the device. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.is_av_engine_loaded | Whether the antivirus engine is loaded. | boolean |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.local_cve_scanner_executed | Whether the local CVE scanner was executed. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.log4j_cve_2021_44228 | Log4j CVE-2021-44228 exposure status. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.log4j_environment_variable_mitigation | Whether the Log4j environment variable mitigation is present. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.log4j_local_scan_vulnerable | Result of the local Log4j vulnerability scan. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.quick_scan_result | Quick scan result of the device. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.spring4shell_cve_2022_22965 | Spring4Shell CVE-2022-22965 exposure status. | keyword |
| microsoft_defender_endpoint.information_gathering.device_gathered_info.wdavor_heartbeat_event_type | Type of the last Defender Antivirus heartbeat event. | keyword |
| microsoft_defender_endpoint.information_gathering.last_seen | Last seen datetime of the device when the information gathering snapshot was collected. | date |
| microsoft_defender_endpoint.information_gathering.os_platform | Platform of the operating system running on the device. | keyword |
| microsoft_defender_endpoint.information_gathering.rbac_group_id | Device group ID that this machine belongs to. | keyword |
| observer.product | The product name of the observer. | constant_keyword |
| observer.vendor | Vendor name of the observer. | constant_keyword |
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 4.15.0 | Enhancement (View pull request) Update Elastic Managed integration documentation to the current wording and docs links. |
9.1.2 8.19.3 |
| 4.14.1 | Bug fix (View pull request) Fix httpjson cursor in the log data stream to read lastUpdateTime from the last split event rather than the (absent) top-level response field, preventing alerts from being re-ingested on every poll interval. If the final event in a batch has a null lastUpdateTime the cursor will not advance for that batch, but progress will resume once a subsequent batch ends with a non-null value. |
9.1.2 8.19.3 |
| 4.14.0 | Enhancement (View pull request) Document the retention applied to source data streams on stateful and Serverless deployments, and how to change it. |
9.1.2 8.19.3 |
| 4.13.0 | Enhancement (View pull request) Add information_gathering data stream to collect per-device TVM information gathering posture snapshots via the InfoGatheringExport API. Enhancement (View pull request) Add configuration data stream to collect secure configuration assessment snapshots from the SecureConfigurationsAssessmentByMachine API. Enhancement (View pull request) Add baseline data stream to collect security baseline compliance snapshots from the baselineComplianceAssessmentByMachine API. |
9.1.2 8.19.3 |
| 4.12.0 | Enhancement (View pull request) Re-order integration inputs to show CEL before HTTPJSON and align input and data stream titles with Microsoft Defender for Endpoint API semantics. |
9.1.2 8.19.3 |
| 4.11.0 | Enhancement (View pull request) Set number_of_shards: 3 on the latest_cdr_vuln transform destination index and bump its destination index version to avoid Elasticsearch shard-size warnings at scale. |
9.1.2 8.19.3 |
| 4.10.0 | Enhancement (View pull request) Add tags to ingest pipeline processors. |
9.1.2 8.19.3 |
| 4.9.1 | Enhancement (View pull request) Set agentless deployment mode release field to ga. |
9.1.2 8.19.3 |
| 4.9.0 | Enhancement (View pull request) Publish Agentless to Elastic Managed integrations name change. |
9.1.2 8.19.3 |
| 4.8.0 | Enhancement (View pull request) Use new release field for agentless deployment mode to establish as beta. |
9.1.2 8.19.3 |
| 4.7.1 | Bug fix (View pull request) Change page_size/batch_size variable type from text to integer for Fleet input validation. |
9.1.2 8.19.3 |
| 4.7.0 | Enhancement (View pull request) Switch vulnerability data stream from gzip export API (SoftwareVulnerabilitiesExport) to paginated delta API (SoftwareVulnerabilityChangesByMachine) to eliminate in-memory gzip decompression and reduce RSS usage. Add initial_interval variable, new EventTimestamp and Status fields. Remove SAS Valid Hours and Max Retries variables. Widen transform retention from 4h to 90d for incremental semantics. Bump transform version to trigger reinstall. |
9.1.2 8.19.3 |
| 4.6.0 | Enhancement (View pull request) Add timestamp range filter and storage tier exclusion to latest transform source queries to reduce scan scope and improve performance. |
9.1.2 8.19.3 |
| 4.5.2 | Bug fix (View pull request) Handle empty response in vulnerability data stream. |
9.1.2 8.19.3 |
| 4.5.1 | Bug fix (View pull request) Lowercase Vidyard video thumbnail URL for docs-builder compatibility |
9.1.2 8.19.3 |
| 4.5.0 | Enhancement (View pull request) Add demo video link to integration documentation. |
9.1.2 8.19.3 |
| 4.4.0 | Enhancement (View pull request) Removed ECS field definitions from CDR transform destinations, now covered by ecs@mappings component template. Renamed overridden ECS fields files to ecs-overridden.yml. |
9.1.2 8.19.3 |
| 4.3.1 | Bug fix (View pull request) Remove duplicate security-solution-default tag references |
9.1.2 8.19.3 |
| 4.3.0 | Enhancement (View pull request) Update the documentation to reflect the latest changes in the vulnerability data stream. |
9.1.2 8.19.3 |
| 4.2.0 | Enhancement (View pull request) Add cloudsecurity_cdr sub category label |
9.1.2 8.19.3 |
| 4.1.2 | Bug fix (View pull request) Handle expired URLs in vulnerability data stream. |
9.1.2 8.19.3 |
| 4.1.1 | Bug fix (View pull request) Update transform to filter out documents containing an error.message from vulnerability latest index |
9.1.2 8.19.3 |
| 4.1.0 | Enhancement (View pull request) Add support for OAuth2 Endpoint Params option. |
9.1.2 8.19.3 |
| 4.0.0 | Enhancement (View pull request) Fetch vulnerability data using SoftwareVulnerabilitiesExport API endpoint. Breaking change (View pull request) The following fields are no longer available in the new implementation: "cloud.provider", "cloud.resource_id", "cloud.instance.id", "host.geo", "host.ip", "host.risk.calculated_level", "related.ip", "vulnerability.description", "vulnerability.published_date", "vulnerability.score.version". |
9.1.2 8.19.3 |
| 3.1.2 | Bug fix (View pull request) Ensure page_size configuration is preserved in CEL evaluation responses. |
9.1.2 8.19.2 |
| 3.1.1 | Bug fix (View pull request) Ensure large $skip API parameter values are correctly formatted in vulnerability data stream. |
9.1.2 8.19.2 |
| 3.1.0 | Enhancement (View pull request) Add vulnerability_workflow sub category label. |
9.1.2 8.19.2 |
| 3.0.1 | Bug fix (View pull request) Extract process.name from process.command_line in log data stream. |
9.1.2 8.19.2 |
| 3.0.0 | Breaking change (View pull request) Add mapping changes and latest transform in vulnerability data stream for Cloud Detection and Response (CDR) vulnerability workflow. |
9.1.2 8.19.2 |
| 2.43.0 | Enhancement (View pull request) Add support for SSL configuration for log data stream. |
9.0.0 8.18.0 |
| 2.42.2 | Bug fix (View pull request) Fix handling of empty string IP values. |
9.0.0 8.18.0 |
| 2.42.1 | Bug fix (View pull request) Fix agent handling of empty and error results in vulnerability data stream. |
9.0.0 8.18.0 |
| 2.42.0 | Enhancement (View pull request) Add process.name ECS mapping in log data stream. |
9.0.0 8.18.0 |
| 2.41.0 | Enhancement (View pull request) Use terminate processor instead of fail processor to handle agent errors. |
9.0.0 8.18.0 |
| 2.40.0 | Enhancement (View pull request) Added support for Initial Interval in Config Options. |
9.0.0 8.18.0 |
| 2.39.0 | Enhancement (View pull request) Standardize user fields processing across integrations. |
9.0.0 8.18.0 |
| 2.38.1 | Bug fix (View pull request) Add temporary processor to remove the fields added by the Agentless policy. |
9.0.0 8.18.0 |
| 2.38.0 | Enhancement (View pull request) Add vulnerability data stream. |
9.0.0 8.18.0 |
| 2.37.0 | Enhancement (View pull request) Map microsoft_defender_endpoint.machine.aad_device_id to device.id. |
9.0.0 8.18.0 |
| 2.36.0 | Enhancement (View pull request) Add process.entity_id and process.parent.entity_id ECS mappings in log data stream. |
9.0.0 8.18.0 |
| 2.35.0 | Enhancement (View pull request) Normalize event.severity values across EDR integrations. |
9.0.0 8.18.0 |
| 2.34.0 | Enhancement (View pull request) Remove redundant installation instructions. |
9.0.0 8.18.0 |
| 2.33.1 | Bug fix (View pull request) Fix default request trace enabled behavior. |
9.0.0 8.18.0 |
| 2.33.0 | Enhancement (View pull request) Add machine and machine action data streams. |
9.0.0 8.18.0 |
| 2.32.0 | Enhancement (View pull request) Update host.* ECS mappings. |
9.0.0 8.18.0 |
| 2.31.0 | Enhancement (View pull request) Enable request trace log removal. |
9.0.0 8.18.0 |
| 2.30.1 | Bug fix (View pull request) Fix overview dashboard by removing reference to event.integration. |
9.0.0 8.18.0 |
| 2.30.0 | Enhancement (View pull request) Enable Agentless deployment. |
9.0.0 8.18.0 |
| 2.29.0 | Enhancement (View pull request) Add support for Kibana 9.0.0 |
9.0.0 8.13.0 |
| 2.28.0 | Enhancement (View pull request) Allow the usage of deprecated log input and support for stack 9.0 |
8.13.0 |
| 2.27.1 | Bug fix (View pull request) Fix null reference for description field. |
8.13.0 |
| 2.27.0 | Enhancement (View pull request) Do not remove event.original in main ingest pipeline. |
8.13.0 |
| 2.26.0 | Enhancement (View pull request) Add "preserve_original_event" tag to documents with event.kind set to "pipeline_error". |
8.13.0 |
| 2.25.1 | Bug fix (View pull request) Use triple-brace Mustache templating when referencing variables in ingest pipelines. |
8.13.0 |
| 2.25.0 | Enhancement (View pull request) Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. |
8.13.0 |
| 2.24.2 | Bug fix (View pull request) Fix bug handling message field when events are received from Logstash with ecs_compatibility turned on. |
8.12.0 |
| 2.24.1 | Bug fix (View pull request) Fix handling of empty arrays. |
8.12.0 |
| 2.24.0 | Enhancement (View pull request) Set sensitive values as secret. |
8.12.0 |
| 2.23.3 | Bug fix (View pull request) Clean up null handling |
8.7.1 |
| 2.23.2 | Enhancement (View pull request) Changed owners |
8.7.1 |
| 2.23.1 | Bug fix (View pull request) Fix exclude_files pattern. |
8.7.1 |
| 2.23.0 | Enhancement (View pull request) Limit request tracer log count to five. |
8.7.1 |
| 2.22.0 | Enhancement (View pull request) ECS version updated to 8.11.0. |
8.7.1 |
| 2.21.0 | Enhancement (View pull request) Improve 'event.original' check to avoid errors if set. |
8.7.1 |
| 2.20.0 | Enhancement (View pull request) Update the package format_version to 3.0.0. |
8.7.1 |
| 2.19.0 | Enhancement (View pull request) Update package to ECS 8.10.0 and align ECS categorization fields. |
8.7.1 |
| 2.18.0 | Enhancement (View pull request) Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. |
8.7.1 |
| 2.17.0 | Enhancement (View pull request) Update package to ECS 8.9.0. |
8.7.1 |
| 2.16.0 | Enhancement (View pull request) Update package-spec to 2.9.0. |
8.7.1 |
| 2.15.0 | Enhancement (View pull request) Convert visualizations to lens. |
8.7.1 |
| 2.14.0 | Enhancement (View pull request) Document valid duration units. |
8.7.1 |
| 2.13.0 | Enhancement (View pull request) Ensure event.kind is correctly set for pipeline errors. |
8.7.1 |
| 2.12.0 | Enhancement (View pull request) Update package to ECS 8.8.0. |
8.7.1 |
| 2.11.0 | Enhancement (View pull request) Lowercase host.name field |
8.7.1 |
| 2.10.0 | Enhancement (View pull request) Add a new flag to enable request tracing |
8.7.1 |
| 2.9.0 | Enhancement (View pull request) Update package to ECS 8.7.0. |
8.1.0 |
| 2.8.2 | Enhancement (View pull request) Added categories and/or subcategories. |
8.1.0 |
| 2.8.1 | Bug fix (View pull request) Drop empty event sets. |
8.1.0 |
| 2.8.0 | Enhancement (View pull request) Adding support for Oauth2 scopes that is required for some users |
8.1.0 |
| 2.7.0 | Enhancement (View pull request) Update package to ECS 8.6.0. |
8.1.0 |
| 2.6.0 | Enhancement (View pull request) Adds support for newer Oauth Token URL |
8.1.0 |
| 2.5.2 | Enhancement (View pull request) Migrate the visualizations to by value in dashboards to minimize the saved object clutter and reduce time to load |
8.1.0 |
| 2.5.1 | Bug fix (View pull request) Remove duplicate fields. |
8.0.0 7.14.1 |
| 2.5.0 | Enhancement (View pull request) Update package to ECS 8.5.0. |
8.0.0 7.14.1 |
| 2.4.0 | Enhancement (View pull request) Update package to ECS 8.4.0 |
8.0.0 7.14.1 |
| 2.3.1 | Bug fix (View pull request) Fix proxy URL documentation rendering. |
8.0.0 7.14.1 |
| 2.3.0 | Enhancement (View pull request) Update package to ECS 8.3.0. |
8.0.0 7.14.1 |
| 2.2.1 | Enhancement (View pull request) Update to Readme to include link to vendor documentation |
8.0.0 7.14.1 |
| 2.2.0 | Enhancement (View pull request) Update to ECS 8.2 |
8.0.0 7.14.1 |
| 2.1.0 | Enhancement (View pull request) Add possibility to choose azure resource |
8.0.0 7.14.1 |
| 2.0.1 | Enhancement (View pull request) Add documentation for multi-fields |
8.0.0 7.14.1 |
| 2.0.0 | Enhancement (View pull request) Update to ECS 8.0 |
8.0.0 7.14.1 |
| 1.1.0 | Enhancement (View pull request) Add 8.0.0 version constraint |
8.0.0 7.14.1 |
| 1.0.2 | Enhancement (View pull request) Update Title and Description. |
7.14.1 |
| 1.0.1 | Bug fix (View pull request) Fix logic that checks for the 'forwarded' tag |
— |
| 1.0.0 | Enhancement (View pull request) First version |
— |