Repository: elastic/integrations
Pull request #13166: [m365_defender] Add toggle button for including unknown Enum members
Author: login: navnit-elastic
Labels: name: enhancement
description: New feature or request
name: Integration:m365_defender
description: Microsoft Defender XDR
name: Team:Security-Service Integrations
description: Security Service Integrations team [elastic/security-service-integrations]
name: Team:SDE-Crest
description: Crest developers on the Security Integrations team [elastic/sit-crest-contractors]
Created: 2025-03-19T11:07:38Z | Merged: 2025-03-20T09:31:21Z

## Proposed commit message

Provide an option to specify the `Prefer: include-unknown-enum-members` header for the alert data stream to handle future members in evolvable enumerations.
Enable toggle button to retrieve unknown members for properties of evolvable enum types.

## Checklist

- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.
- [ ] I have verified that all data streams collect metrics or logs.
- [x] I have added an entry to my package's `changelog.yml` file.
- [ ] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).
- [ ] I have verified that any added dashboard complies with Kibana's [Dashboard good practices](https://docs.elastic.dev/ux-guidelines/data-viz/dashboard-good-practices) 

## Author's Checklist

<!-- Recommended
Add a checklist of things that are required to be reviewed in order to have the PR approved
-->
- [ ] 

## How to test this PR locally
Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/m365_defender directory.
Run the following command to run tests.
`elastic-package test -v`

## Related issues

- Closes #12573 


Linked issue #12573: [m365_defender.alert] Prefer: include-unknown-enum-members Header
### Integration Name

Microsoft M365 Defender [m365_defender]

### Dataset Name

m365_defender.alert

### Integration Version

Latest

### Agent Version

Latest

### Agent Output Type

elasticsearch

### Elasticsearch Version

Latest

### OS Version and Architecture

Latest

### Software/API Version

_No response_

### Error Message

None

### Event Original

irrelevant 

### What did you do?

Use the integration 

### What did you see?

unknow field values

### What did you expect to see?

field values 

### Anything else?

The Alerts integration has no option to specify the following header, maybe this can be a toggle option for people that want to use it but its very useful.

Prefer: include-unknown-enum-members
https://learn.microsoft.com/en-us/graph/best-practices-concept#handling-future-members-in-evolvable-enumerations  

without this we cant get the following values - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0#:~:text=Prefer%3A%20include%2Dunknown,microsoftDefenderThreatIntelligenceAnalytics%2C%20builtInMl, which are very useful.


Linked issue comments: user: login: elasticmachine
created_at: 2025-02-03T17:04:30Z
body: Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
author_association: NONE

Diff:
diff --git a/packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml b/packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml
index cc4310826ea..7c542e37370 100644
--- a/packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml
+++ b/packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml
@@ -21,6 +21,8 @@ rules:
     request_headers:
       Authorization:
         - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN"
+      Prefer:
+        - "include-unknown-enum-members"
     responses:
       - status_code: 200
         headers:
@@ -378,6 +380,8 @@ rules:
     request_headers:
       Authorization:
         - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN"
+      Prefer:
+        - "include-unknown-enum-members"
     responses:
       - status_code: 200
         headers:
@@ -394,8 +398,8 @@ rules:
                 "severity": "low",
                 "classification": null,
                 "determination": null,
-                "serviceSource": "microsoftDefenderForEndpoint",
-                "detectionSource": "microsoftDefenderForEndpoint",
+                "serviceSource": "microsoftDefenderForCloud",
+                "detectionSource": "microsoftDefenderForCloud",
                 "productName": "Microsoft Defender for Endpoint",
                 "detectorId": "9bfe28a9-21eb-4f8a-b51e-38ebd3650c88",
                 "tenantId": "3adb963c-8e61-48e8-a06d-6dbb0dacea39",
diff --git a/packages/m365_defender/changelog.yml b/packages/m365_defender/changelog.yml
index 80e0612be7e..139d079fc0b 100644
--- a/packages/m365_defender/changelog.yml
+++ b/packages/m365_defender/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.25.0"
+  changes:
+    - description: Add a toggle button for including unknown members in properties of evolvable enum types.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13166
 - version: "2.24.0"
   changes:
     - description: Enable Agentless deployment.
diff --git a/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log b/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log
index cc1c1c82540..5899826d19f 100644
--- a/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log
+++ b/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log
@@ -1,3 +1,4 @@
 {"id":"daefa1828b-dd4e-405c-8a3b-aa28596830dd_1","providerAlertId":"efa1828b-dd4e-405c-8a3b-aa28596830dd_1","incidentId":"23","status":"new","severity":"medium","classification":null,"determination":null,"serviceSource":"microsoftDefenderForEndpoint","detectionSource":"microsoftDefenderForEndpoint","productName":"Microsoft Defender for Endpoint","detectorId":"7f1c3609-a3ff-40e2-995b-c01770161d68","tenantId":"3adb963c-8e61-48e8-a06d-6dbb0dacea39","title":"Suspicious PowerShell command line","description":"A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.","recommendedActions":"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.","category":"Execution","assignedTo":null,"alertWebUrl":"https:\/\/security.microsoft.com\/alerts\/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","incidentWebUrl":"https:\/\/security.microsoft.com\/incidents\/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","actorDisplayName":null,"threatDisplayName":null,"threatFamilyName":null,"mitreTechniques":["T1059.001"],"createdDateTime":"2023-10-20T09:53:09.8839373Z","lastUpdateDateTime":"2023-10-20T09:54:07.5033333Z","resolvedDateTime":null,"firstActivityDateTime":"2023-10-20T09:51:39.5154802Z","lastActivityDateTime":"2023-10-20T09:51:41.9939003Z","alertPolicyId":null,"additionalData":null,"comments":[],"evidence":[{"@odata.type":"#microsoft.graph.security.deviceEvidence","createdDateTime":"2023-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":["PrimaryDevice"],"tags":[],"firstSeenDateTime":"2023-10-20T09:50:17.7383987Z","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","azureAdDeviceId":"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14","deviceDnsName":"clw555test","osPlatform":"Windows11","osBuild":22621,"version":"22H2","healthStatus":"inactive","riskScore":"high","rbacGroupId":0,"rbacGroupName":null,"onboardingStatus":"onboarded","defenderAvStatus":"notSupported","ipInterfaces":["192.168.5.65","fe80::cfe4:80b:615c:38fb","127.0.0.1","::1"],"vmMetadata":null,"loggedOnUsers":[{"accountName":"CDPUserIS-38411","domainName":"AzureAD"}]},{"@odata.type":"#microsoft.graph.security.userEvidence","createdDateTime":"2023-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}},{"@odata.type":"#microsoft.graph.security.urlEvidence","createdDateTime":"2023-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"url":"http:\/\/127.0.0.1\/1.exe"},{"@odata.type":"#microsoft.graph.security.ipEvidence","createdDateTime":"2023-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"ipAddress":"127.0.0.1","countryLetterCode":null},{"@odata.type":"#microsoft.graph.security.processEvidence","createdDateTime":"2023-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"processId":8224,"parentProcessId":5772,"processCommandLine":"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http:\/\/127.0.0.1\/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'","processCreationDateTime":"2023-10-20T09:51:39.4997961Z","parentProcessCreationDateTime":"2023-10-20T09:51:19.5064237Z","detectionStatus":"detected","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","imageFile":{"sha1":"a72c41316307889e43fe8605a0dca4a72e72a011","sha256":"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","fileSize":491520,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"parentProcessImageFile":{"sha1":null,"sha256":null,"fileName":"cmd.exe","filePath":"C:\\Windows\\System32","fileSize":323584,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}}]}
 {"id":"daefa1828b-dd4e-405c-8a3b-aa28596830dd_2","providerAlertId":"efa1828b-dd4e-405c-8a3b-aa28596830dd_2","incidentId":"33","status":"new","severity":"medium","classification":null,"determination":null,"serviceSource":"microsoftDefenderForEndpoint","detectionSource":"microsoftDefenderForEndpoint","productName":"Microsoft Defender for Endpoint","detectorId":"7f1c3609-a3ff-40e2-995b-c01770161d68","tenantId":"3adb963c-8e61-48e8-a06d-6dbb0dacea39","title":"Suspicious PowerShell command line","description":"A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.","recommendedActions":"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.","category":"Execution","assignedTo":null,"alertWebUrl":"https:\/\/security.microsoft.com\/alerts\/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","incidentWebUrl":"https:\/\/security.microsoft.com\/incidents\/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","actorDisplayName":null,"threatDisplayName":null,"threatFamilyName":null,"mitreTechniques":["T1059.001"],"createdDateTime":"2024-10-20T09:53:09.8839373Z","lastUpdateDateTime":"2024-10-20T09:54:07.5033333Z","resolvedDateTime":null,"firstActivityDateTime":"2024-10-20T09:51:39.5154802Z","lastActivityDateTime":"2024-10-20T09:51:41.9939003Z","alertPolicyId":null,"additionalData":null,"comments":[],"evidence":[{"internetMessageId":"81ce15$8r2j59@mail01.example.com","networkMessageId":"c26dbea0-80d5-463b-b93c-4e8b708219ce","senderIp": "81.2.69.142","@odata.type":"#microsoft.graph.security.deviceEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":["PrimaryDevice"],"tags":[],"firstSeenDateTime":"2024-10-20T09:50:17.7383987Z","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","azureAdDeviceId":"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14","deviceDnsName":"clw555test","osPlatform":"Windows11","osBuild":22621,"version":"22H2","healthStatus":"inactive","riskScore":"high","rbacGroupId":0,"rbacGroupName":null,"onboardingStatus":"onboarded","defenderAvStatus":"notSupported","ipInterfaces":["192.168.5.65","fe80::cfe4:80b:615c:38fb","127.0.0.1","::1"],"vmMetadata":null,"loggedOnUsers":[{"accountName":"CDPUserIS-38411","domainName":"AzureAD"}]},{"@odata.type":"#microsoft.graph.security.userEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}},{"@odata.type":"#microsoft.graph.security.urlEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"url":"http:\/\/127.0.0.1\/1.exe"},{"@odata.type":"#microsoft.graph.security.ipEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"ipAddress":"127.0.0.1","countryLetterCode":null},{"@odata.type":"#microsoft.graph.security.processEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"processId":8224,"parentProcessId":5772,"processCommandLine":"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http:\/\/127.0.0.1\/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'","processCreationDateTime":"2024-10-20T09:51:39.4997961Z","parentProcessCreationDateTime":"2024-10-20T09:51:19.5064237Z","detectionStatus":"detected","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","imageFile":{"sha1":"a72c41316307889e43fe8605a0dca4a72e72a011","sha256":"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","fileSize":491520,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"parentProcessImageFile":{"sha1":null,"sha256":null,"fileName":"cmd.exe","filePath":"C:\\Windows\\System32","fileSize":323584,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}}]}
+{"id":"daefa1828b-dd4e-405c-8a3b-aa28596830dd_2","providerAlertId":"efa1828b-dd4e-405c-8a3b-aa28596830dd_2","incidentId":"33","status":"new","severity":"medium","classification":null,"determination":null,"serviceSource":"microsoftDefenderForCloud","detectionSource":"microsoftDefenderForCloud","productName":"Microsoft Defender for Endpoint","detectorId":"7f1c3609-a3ff-40e2-995b-c01770161d68","tenantId":"3adb963c-8e61-48e8-a06d-6dbb0dacea39","title":"Suspicious PowerShell command line","description":"A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.","recommendedActions":"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.","category":"Execution","assignedTo":null,"alertWebUrl":"https:\/\/security.microsoft.com\/alerts\/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","incidentWebUrl":"https:\/\/security.microsoft.com\/incidents\/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39","actorDisplayName":null,"threatDisplayName":null,"threatFamilyName":null,"mitreTechniques":["T1059.001"],"createdDateTime":"2024-10-20T09:53:09.8839373Z","lastUpdateDateTime":"2024-10-20T09:54:07.5033333Z","resolvedDateTime":null,"firstActivityDateTime":"2024-10-20T09:51:39.5154802Z","lastActivityDateTime":"2024-10-20T09:51:41.9939003Z","alertPolicyId":null,"additionalData":null,"comments":[],"evidence":[{"internetMessageId":"81ce15$8r2j59@mail01.example.com","networkMessageId":"c26dbea0-80d5-463b-b93c-4e8b708219ce","senderIp": "81.2.69.142","@odata.type":"#microsoft.graph.security.deviceEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":["PrimaryDevice"],"tags":[],"firstSeenDateTime":"2024-10-20T09:50:17.7383987Z","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","azureAdDeviceId":"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14","deviceDnsName":"clw555test","osPlatform":"Windows11","osBuild":22621,"version":"22H2","healthStatus":"inactive","riskScore":"high","rbacGroupId":0,"rbacGroupName":null,"onboardingStatus":"onboarded","defenderAvStatus":"notSupported","ipInterfaces":["192.168.5.65","fe80::cfe4:80b:615c:38fb","127.0.0.1","::1"],"vmMetadata":null,"loggedOnUsers":[{"accountName":"CDPUserIS-38411","domainName":"AzureAD"}]},{"@odata.type":"#microsoft.graph.security.userEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}},{"@odata.type":"#microsoft.graph.security.urlEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"url":"http:\/\/127.0.0.1\/1.exe"},{"@odata.type":"#microsoft.graph.security.ipEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"suspicious","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"ipAddress":"127.0.0.1","countryLetterCode":null},{"@odata.type":"#microsoft.graph.security.processEvidence","createdDateTime":"2024-10-20T09:53:10.1933333Z","verdict":"unknown","remediationStatus":"none","remediationStatusDetails":null,"roles":[],"detailedRoles":[],"tags":[],"processId":8224,"parentProcessId":5772,"processCommandLine":"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http:\/\/127.0.0.1\/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'","processCreationDateTime":"2024-10-20T09:51:39.4997961Z","parentProcessCreationDateTime":"2024-10-20T09:51:19.5064237Z","detectionStatus":"detected","mdeDeviceId":"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843","imageFile":{"sha1":"a72c41316307889e43fe8605a0dca4a72e72a011","sha256":"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","fileSize":491520,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"parentProcessImageFile":{"sha1":null,"sha256":null,"fileName":"cmd.exe","filePath":"C:\\Windows\\System32","fileSize":323584,"filePublisher":"Microsoft Corporation","signer":null,"issuer":null},"userAccount":{"accountName":"CDPUserIS-38411","domainName":"AzureAD","userSid":"S-1-12-1-1485667349-1150190949-4065799612-2328216759","azureAdUserId":null,"userPrincipalName":null,"displayName":null}}]}
 {"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/alerts_v2","value":[]}
\ No newline at end of file
diff --git a/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json
index ecc8b4a03a3..09aa90ed886 100644
--- a/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json
+++ b/packages/m365_defender/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json
@@ -547,6 +547,287 @@
                 ]
             }
         },
+        {
+            "@timestamp": "2024-10-20T09:54:07.503Z",
+            "cloud": {
+                "account": {
+                    "id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "email": {
+                "local_id": [
+                    "c26dbea0-80d5-463b-b93c-4e8b708219ce"
+                ],
+                "message_id": [
+                    "81ce15$8r2j59@mail01.example.com"
+                ]
+            },
+            "event": {
+                "action": [
+                    "detected"
+                ],
+                "category": [
+                    "host",
+                    "iam",
+                    "network",
+                    "process"
+                ],
+                "created": "2024-10-20T09:53:09.883Z",
+                "duration": 2478000000,
+                "end": "2024-10-20T09:51:41.993Z",
+                "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_2",
+                "kind": "alert",
+                "original": "{\"id\":\"daefa1828b-dd4e-405c-8a3b-aa28596830dd_2\",\"providerAlertId\":\"efa1828b-dd4e-405c-8a3b-aa28596830dd_2\",\"incidentId\":\"33\",\"status\":\"new\",\"severity\":\"medium\",\"classification\":null,\"determination\":null,\"serviceSource\":\"microsoftDefenderForCloud\",\"detectionSource\":\"microsoftDefenderForCloud\",\"productName\":\"Microsoft Defender for Endpoint\",\"detectorId\":\"7f1c3609-a3ff-40e2-995b-c01770161d68\",\"tenantId\":\"3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"title\":\"Suspicious PowerShell command line\",\"description\":\"A suspicious PowerShell activity was observed on the machine. \\nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.\",\"recommendedActions\":\"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.\",\"category\":\"Execution\",\"assignedTo\":null,\"alertWebUrl\":\"https:\\/\\/security.microsoft.com\\/alerts\\/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"incidentWebUrl\":\"https:\\/\\/security.microsoft.com\\/incidents\\/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"actorDisplayName\":null,\"threatDisplayName\":null,\"threatFamilyName\":null,\"mitreTechniques\":[\"T1059.001\"],\"createdDateTime\":\"2024-10-20T09:53:09.8839373Z\",\"lastUpdateDateTime\":\"2024-10-20T09:54:07.5033333Z\",\"resolvedDateTime\":null,\"firstActivityDateTime\":\"2024-10-20T09:51:39.5154802Z\",\"lastActivityDateTime\":\"2024-10-20T09:51:41.9939003Z\",\"alertPolicyId\":null,\"additionalData\":null,\"comments\":[],\"evidence\":[{\"internetMessageId\":\"81ce15$8r2j59@mail01.example.com\",\"networkMessageId\":\"c26dbea0-80d5-463b-b93c-4e8b708219ce\",\"senderIp\": \"81.2.69.142\",\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"createdDateTime\":\"2024-10-20T09:53:10.1933333Z\",\"verdict\":\"unknown\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"detailedRoles\":[\"PrimaryDevice\"],\"tags\":[],\"firstSeenDateTime\":\"2024-10-20T09:50:17.7383987Z\",\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"azureAdDeviceId\":\"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14\",\"deviceDnsName\":\"clw555test\",\"osPlatform\":\"Windows11\",\"osBuild\":22621,\"version\":\"22H2\",\"healthStatus\":\"inactive\",\"riskScore\":\"high\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"onboardingStatus\":\"onboarded\",\"defenderAvStatus\":\"notSupported\",\"ipInterfaces\":[\"192.168.5.65\",\"fe80::cfe4:80b:615c:38fb\",\"127.0.0.1\",\"::1\"],\"vmMetadata\":null,\"loggedOnUsers\":[{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\"}]},{\"@odata.type\":\"#microsoft.graph.security.userEvidence\",\"createdDateTime\":\"2024-10-20T09:53:10.1933333Z\",\"verdict\":\"unknown\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"detailedRoles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\",\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\",\"azureAdUserId\":null,\"userPrincipalName\":null,\"displayName\":null}},{\"@odata.type\":\"#microsoft.graph.security.urlEvidence\",\"createdDateTime\":\"2024-10-20T09:53:10.1933333Z\",\"verdict\":\"suspicious\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"detailedRoles\":[],\"tags\":[],\"url\":\"http:\\/\\/127.0.0.1\\/1.exe\"},{\"@odata.type\":\"#microsoft.graph.security.ipEvidence\",\"createdDateTime\":\"2024-10-20T09:53:10.1933333Z\",\"verdict\":\"suspicious\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"detailedRoles\":[],\"tags\":[],\"ipAddress\":\"127.0.0.1\",\"countryLetterCode\":null},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2024-10-20T09:53:10.1933333Z\",\"verdict\":\"unknown\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"detailedRoles\":[],\"tags\":[],\"processId\":8224,\"parentProcessId\":5772,\"processCommandLine\":\"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http:\\/\\/127.0.0.1\\/1.exe', 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe');Start-Process 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe'\",\"processCreationDateTime\":\"2024-10-20T09:51:39.4997961Z\",\"parentProcessCreationDateTime\":\"2024-10-20T09:51:19.5064237Z\",\"detectionStatus\":\"detected\",\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"imageFile\":{\"sha1\":\"a72c41316307889e43fe8605a0dca4a72e72a011\",\"sha256\":\"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80\",\"fileName\":\"powershell.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\",\"fileSize\":491520,\"filePublisher\":\"Microsoft Corporation\",\"signer\":null,\"issuer\":null},\"parentProcessImageFile\":{\"sha1\":null,\"sha256\":null,\"fileName\":\"cmd.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"fileSize\":323584,\"filePublisher\":\"Microsoft Corporation\",\"signer\":null,\"issuer\":null},\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\",\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\",\"azureAdUserId\":null,\"userPrincipalName\":null,\"displayName\":null}}]}",
+                "provider": "microsoftDefenderForCloud",
+                "severity": 3,
+                "start": "2024-10-20T09:51:39.515Z",
+                "type": [
+                    "info"
+                ],
+                "url": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39"
+            },
+            "host": {
+                "id": [
+                    "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843"
+                ],
+                "ip": [
+                    "127.0.0.1"
+                ],
+                "os": {
+                    "name": [
+                        "Windows11"
+                    ],
+                    "version": [
+                        "22H2"
+                    ]
+                }
+            },
+            "m365_defender": {
+                "alert": {
+                    "category": "Execution",
+                    "created_datetime": "2024-10-20T09:53:09.883Z",
+                    "description": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.",
+                    "detection_source": "microsoftDefenderForCloud",
+                    "detector_id": "7f1c3609-a3ff-40e2-995b-c01770161d68",
+                    "evidence": [
+                        {
+                            "azure_ad_device_id": "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14",
+                            "created_datetime": "2024-10-20T09:53:10.193Z",
+                            "defender_av_status": "notSupported",
+                            "detailed_roles": [
+                                "PrimaryDevice"
+                            ],
+                            "device_dns_name": "clw555test",
+                            "first_seen_datetime": "2024-10-20T09:50:17.738Z",
+                            "health_status": "inactive",
+                            "ip_interfaces": [
+                                "192.168.5.65",
+                                "fe80::cfe4:80b:615c:38fb",
+                                "127.0.0.1",
+                                "::1"
+                            ],
+                            "logged_on_users": [
+                                {
+                                    "account_name": "CDPUserIS-38411",
+                                    "domain_name": "AzureAD"
+                                }
+                            ],
+                            "mde_device_id": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843",
+                            "odata_type": "#microsoft.graph.security.deviceEvidence",
+                            "onboarding_status": "onboarded",
+                            "os_build": "22621",
+                            "os_platform": "Windows11",
+                            "rbac_group": {
+                                "id": "0"
+                            },
+                            "remediation_status": "none",
+                            "risk_score": "high",
+                            "sender_ip": "81.2.69.142",
+                            "verdict": "unknown",
+                            "version": "22H2"
+                        },
+                        {
+                            "created_datetime": "2024-10-20T09:53:10.193Z",
+                            "odata_type": "#microsoft.graph.security.userEvidence",
+                            "remediation_status": "none",
+                            "user_account": {
+                                "account_name": "CDPUserIS-38411",
+                                "domain_name": "AzureAD",
+                                "user_sid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759"
+                            },
+                            "verdict": "unknown"
+                        },
+                        {
+                            "created_datetime": "2024-10-20T09:53:10.193Z",
+                            "odata_type": "#microsoft.graph.security.urlEvidence",
+                            "remediation_status": "none",
+                            "url": "http://127.0.0.1/1.exe",
+                            "verdict": "suspicious"
+                        },
+                        {
+                            "created_datetime": "2024-10-20T09:53:10.193Z",
+                            "ip_address": "127.0.0.1",
+                            "odata_type": "#microsoft.graph.security.ipEvidence",
+                            "remediation_status": "none",
+                            "verdict": "suspicious"
+                        },
+                        {
+                            "created_datetime": "2024-10-20T09:53:10.193Z",
+                            "detection_status": "detected",
+                            "image_file": {
+                                "name": "powershell.exe",
+                                "path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0",
+                                "publisher": "Microsoft Corporation",
+                                "sha1": "a72c41316307889e43fe8605a0dca4a72e72a011",
+                                "sha256": "d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80",
+                                "size": 491520
+                            },
+                            "mde_device_id": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843",
+                            "odata_type": "#microsoft.graph.security.processEvidence",
+                            "parent_process": {
+                                "creation_datetime": "2024-10-20T09:51:19.506Z",
+                                "id": 5772,
+                                "image_file": {
+                                    "name": "cmd.exe",
+                                    "path": "C:\\Windows\\System32",
+                                    "publisher": "Microsoft Corporation",
+                                    "size": 323584
+                                }
+                            },
+                            "process": {
+                                "command_line": "powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'",
+                                "creation_datetime": "2024-10-20T09:51:39.499Z",
+                                "id": 8224
+                            },
+                            "remediation_status": "none",
+                            "user_account": {
+                                "account_name": "CDPUserIS-38411",
+                                "domain_name": "AzureAD",
+                                "user_sid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759"
+                            },
+                            "verdict": "unknown"
+                        }
+                    ],
+                    "first_activity_datetime": "2024-10-20T09:51:39.515Z",
+                    "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_2",
+                    "incident_id": "33",
+                    "incident_web_url": {
+                        "domain": "security.microsoft.com",
+                        "original": "https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
+                        "path": "/incidents/23",
+                        "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
+                        "scheme": "https"
+                    },
+                    "last_activity_datetime": "2024-10-20T09:51:41.993Z",
+                    "last_update_datetime": "2024-10-20T09:54:07.503Z",
+                    "mitre_techniques": [
+                        "T1059.001"
+                    ],
+                    "provider_alert_id": "efa1828b-dd4e-405c-8a3b-aa28596830dd_2",
+                    "recommended_actions": "1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.",
+                    "service_source": "microsoftDefenderForCloud",
+                    "severity": "medium",
+                    "status": "new",
+                    "tenant_id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39",
+                    "title": "Suspicious PowerShell command line",
+                    "web_url": {
+                        "domain": "security.microsoft.com",
+                        "original": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
+                        "path": "/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1",
+                        "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
+                        "scheme": "https"
+                    }
+                }
+            },
+            "message": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.",
+            "process": {
+                "command_line": [
+                    "powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'"
+                ],
+                "hash": {
+                    "sha1": [
+                        "a72c41316307889e43fe8605a0dca4a72e72a011"
+                    ],
+                    "sha256": [
+                        "d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80"
+                    ]
+                },
+                "parent": {
+                    "pid": [
+                        5772
+                    ],
+                    "start": [
+                        "2024-10-20T09:51:19.506Z"
+                    ]
+                },
+                "pid": [
+                    8224
+                ],
+                "start": [
+                    "2024-10-20T09:51:39.499Z"
+                ],
+                "user": {
+                    "name": [
+                        "CDPUserIS-38411"
+                    ]
+                }
+            },
+            "related": {
+                "hash": [
+                    "a72c41316307889e43fe8605a0dca4a72e72a011",
+                    "d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80"
+                ],
+                "hosts": [
+                    "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843",
+                    "Windows11",
+                    "22H2",
+                    "clw555test",
+                    "AzureAD"
+                ],
+                "ip": [
+                    "81.2.69.142",
+                    "127.0.0.1"
+                ],
+                "user": [
+                    "CDPUserIS-38411",
+                    "S-1-12-1-1485667349-1150190949-4065799612-2328216759"
+                ]
+            },
+            "source": {
+                "ip": [
+                    "81.2.69.142"
+                ]
+            },
+            "tags": [
+                "preserve_original_event",
+                "preserve_duplicate_custom_fields"
+            ],
+            "threat": {
+                "tactic": {
+                    "name": [
+                        "Execution"
+                    ]
+                },
+                "technique": {
+                    "subtechnique": {
+                        "id": [
+                            "T1059.001"
+                        ]
+                    }
+                }
+            },
+            "user": {
+                "domain": [
+                    "AzureAD"
+                ],
+                "name": [
+                    "CDPUserIS-38411"
+                ]
+            }
+        },
         null
     ]
 }
diff --git a/packages/m365_defender/data_stream/alert/_dev/test/system/test-default-config.yml b/packages/m365_defender/data_stream/alert/_dev/test/system/test-default-config.yml
index 0cca3f53c76..a331df9ab25 100644
--- a/packages/m365_defender/data_stream/alert/_dev/test/system/test-default-config.yml
+++ b/packages/m365_defender/data_stream/alert/_dev/test/system/test-default-config.yml
@@ -10,6 +10,7 @@ data_stream:
     request_url: http://{{Hostname}}:{{Port}}
     preserve_original_event: true
     preserve_duplicate_custom_fields: true
+    include_unknown_enum_members: true
     batch_size: 2
 assert:
   hit_count: 3
diff --git a/packages/m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs b/packages/m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs
index 9be6254f142..706dc3586a4 100644
--- a/packages/m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs
+++ b/packages/m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs
@@ -32,6 +32,11 @@ request.transforms:
   - set:
       target: url.params.$orderby
       value: 'lastUpdateDateTime asc'
+{{#if include_unknown_enum_members}}
+  - set:
+      target: "header.Prefer"
+      value: 'include-unknown-enum-members'
+{{/if}}
 response.pagination:
   - set:
       target: url.params.$filter
diff --git a/packages/m365_defender/data_stream/alert/manifest.yml b/packages/m365_defender/data_stream/alert/manifest.yml
index 98d02f16c24..88282e08445 100644
--- a/packages/m365_defender/data_stream/alert/manifest.yml
+++ b/packages/m365_defender/data_stream/alert/manifest.yml
@@ -71,6 +71,12 @@ streams:
         type: bool
         multi: false
         default: false
+      - name: include_unknown_enum_members
+        show_user: false
+        title: Include unknown enum members
+        description: Return unknown members for properties of evolvable enum types.
+        type: bool
+        multi: false
       - name: processors
         type: yaml
         title: Processors
diff --git a/packages/m365_defender/data_stream/alert/sample_event.json b/packages/m365_defender/data_stream/alert/sample_event.json
index 21b93c5f236..f81adbd0677 100644
--- a/packages/m365_defender/data_stream/alert/sample_event.json
+++ b/packages/m365_defender/data_stream/alert/sample_event.json
@@ -1,11 +1,11 @@
 {
     "@timestamp": "2023-10-20T09:54:07.503Z",
     "agent": {
-        "ephemeral_id": "5047ff1c-c1ac-4b5f-aaff-47aee13c110b",
-        "id": "54d960cc-1254-43af-8389-292d7627367d",
-        "name": "elastic-agent-15120",
+        "ephemeral_id": "751bd2a5-401a-4045-83ac-932ff4e2399f",
+        "id": "9a796a20-b8fb-4412-a3f1-cdf338987906",
+        "name": "elastic-agent-64558",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "account": {
@@ -14,16 +14,16 @@
     },
     "data_stream": {
         "dataset": "m365_defender.alert",
-        "namespace": "14786",
+        "namespace": "82773",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "54d960cc-1254-43af-8389-292d7627367d",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "9a796a20-b8fb-4412-a3f1-cdf338987906",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": [
@@ -41,7 +41,7 @@
         "duration": 2478000000,
         "end": "2023-10-20T09:51:41.993Z",
         "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1",
-        "ingested": "2024-08-12T16:00:30Z",
+        "ingested": "2025-03-19T06:25:01Z",
         "kind": "alert",
         "original": "{\"actorDisplayName\":null,\"additionalData\":null,\"alertPolicyId\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"assignedTo\":null,\"category\":\"Execution\",\"classification\":null,\"comments\":[],\"createdDateTime\":\"2023-10-20T09:53:09.8839373Z\",\"description\":\"A suspicious PowerShell activity was observed on the machine. \\nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.\",\"detectionSource\":\"microsoftDefenderForEndpoint\",\"detectorId\":\"7f1c3609-a3ff-40e2-995b-c01770161d68\",\"determination\":null,\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":\"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"defenderAvStatus\":\"notSupported\",\"detailedRoles\":[\"PrimaryDevice\"],\"deviceDnsName\":\"clw555test\",\"firstSeenDateTime\":\"2023-10-20T09:50:17.7383987Z\",\"healthStatus\":\"inactive\",\"ipInterfaces\":[\"192.168.5.65\",\"fe80::cfe4:80b:615c:38fb\",\"127.0.0.1\",\"::1\"],\"loggedOnUsers\":[{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\"}],\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22621,\"osPlatform\":\"Windows11\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"high\",\"roles\":[],\"tags\":[],\"verdict\":\"unknown\",\"version\":\"22H2\",\"vmMetadata\":null},{\"@odata.type\":\"#microsoft.graph.security.userEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"azureAdUserId\":null,\"displayName\":null,\"domainName\":\"AzureAD\",\"userPrincipalName\":null,\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.urlEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"url\":\"http://127.0.0.1/1.exe\",\"verdict\":\"suspicious\"},{\"@odata.type\":\"#microsoft.graph.security.ipEvidence\",\"countryLetterCode\":null,\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"ipAddress\":\"127.0.0.1\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"suspicious\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"powershell.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":491520,\"issuer\":null,\"sha1\":\"a72c41316307889e43fe8605a0dca4a72e72a011\",\"sha256\":\"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80\",\"signer\":null},\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"parentProcessCreationDateTime\":\"2023-10-20T09:51:19.5064237Z\",\"parentProcessId\":5772,\"parentProcessImageFile\":{\"fileName\":\"cmd.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":323584,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe');Start-Process 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe'\",\"processCreationDateTime\":\"2023-10-20T09:51:39.4997961Z\",\"processId\":8224,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"azureAdUserId\":null,\"displayName\":null,\"domainName\":\"AzureAD\",\"userPrincipalName\":null,\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\"},\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2023-10-20T09:51:39.5154802Z\",\"id\":\"daefa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"incidentId\":\"23\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"lastActivityDateTime\":\"2023-10-20T09:51:41.9939003Z\",\"lastUpdateDateTime\":\"2023-10-20T09:54:07.5033333Z\",\"mitreTechniques\":[\"T1059.001\"],\"productName\":\"Microsoft Defender for Endpoint\",\"providerAlertId\":\"efa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"recommendedActions\":\"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\\n2. Search the script for more indicators to investigate - for example IP addresses (potential C\\u0026C servers), target computers etc.\\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"medium\",\"status\":\"new\",\"tenantId\":\"3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious PowerShell command line\"}",
         "provider": "microsoftDefenderForEndpoint",
@@ -288,4 +288,4 @@
             "CDPUserIS-38411"
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/packages/m365_defender/data_stream/incident/sample_event.json b/packages/m365_defender/data_stream/incident/sample_event.json
index 4f1e623d11c..0e10cdac8f5 100644
--- a/packages/m365_defender/data_stream/incident/sample_event.json
+++ b/packages/m365_defender/data_stream/incident/sample_event.json
@@ -1,11 +1,11 @@
 {
     "@timestamp": "2021-09-30T09:35:45.113Z",
     "agent": {
-        "ephemeral_id": "cd25528a-43c2-4c2b-9dfd-f46ec8044067",
-        "id": "d0cc4e5a-22d2-441c-b3e3-b77013785358",
-        "name": "elastic-agent-63564",
+        "ephemeral_id": "fe161e56-e2bb-430b-8e88-deaa344fd902",
+        "id": "780e6db9-8212-48d3-afa0-561b61606506",
+        "name": "elastic-agent-28930",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "account": {
@@ -17,16 +17,16 @@
     },
     "data_stream": {
         "dataset": "m365_defender.incident",
-        "namespace": "13281",
+        "namespace": "60062",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "d0cc4e5a-22d2-441c-b3e3-b77013785358",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "780e6db9-8212-48d3-afa0-561b61606506",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": [
@@ -36,7 +36,7 @@
         "created": "2021-08-13T08:43:35.553Z",
         "dataset": "m365_defender.incident",
         "id": "2972395",
-        "ingested": "2024-08-12T16:01:29Z",
+        "ingested": "2025-03-19T06:25:50Z",
         "kind": "alert",
         "original": "{\"@odata.type\":\"#microsoft.graph.security.incident\",\"alerts\":{\"@odata.type\":\"#microsoft.graph.security.alert\",\"actorDisplayName\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"assignedTo\":null,\"category\":\"DefenseEvasion\",\"classification\":\"unknown\",\"comments\":[],\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"description\":\"A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.\",\"detectionSource\":\"antivirus\",\"detectorId\":\"e0da400f-affd-43ef-b1d5-afc2eb6f2756\",\"determination\":\"unknown\",\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":null,\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"defenderAvStatus\":\"unknown\",\"deviceDnsName\":\"tempDns\",\"firstSeenDateTime\":\"2020-09-12T07:28:32.4321753Z\",\"healthStatus\":\"active\",\"loggedOnUsers\":[],\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22424,\"osPlatform\":\"Windows10\",\"rbacGroupId\":75,\"rbacGroupName\":\"UnassignedGroup\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"medium\",\"roles\":[\"compromised\"],\"tags\":[\"Test Machine\"],\"verdict\":\"unknown\",\"version\":\"Other\",\"vmMetadata\":{\"cloudProvider\":\"azure\",\"resourceId\":\"/subscriptions/8700d3a3-3bb7-4fbe-a090-488a1ad04161/resourceGroups/WdatpApi-EUS-STG/providers/Microsoft.Compute/virtualMachines/NirLaviTests\",\"subscriptionId\":\"8700d3a3-3bb7-4fbe-a090-488a1ad04161\",\"vmId\":\"ca1b0d41-5a3b-4d95-b48b-f220aed11d78\"}},{\"@odata.type\":\"#microsoft.graph.security.fileEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"fileDetails\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"parentProcessCreationDateTime\":\"2021-08-12T07:39:09.0909239Z\",\"parentProcessId\":668,\"parentProcessImageFile\":{\"fileName\":\"services.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":731744,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"\\\"MsSense.exe\\\"\",\"processCreationDateTime\":\"2021-08-12T12:43:19.0772577Z\",\"processId\":4780,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"SYSTEM\",\"azureAdUserId\":null,\"domainName\":\"NT AUTHORITY\",\"userPrincipalName\":null,\"userSid\":\"S-1-5-18\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.registryKeyEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"registryHive\":\"HKEY_LOCAL_MACHINE\",\"registryKey\":\"SYSTEM\\\\CONTROLSET001\\\\CONTROL\\\\WMI\\\\AUTOLOGGER\\\\SENSEAUDITLOGGER\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2021-04-26T07:45:50.116Z\",\"id\":\"da637551227677560813_-961444813\",\"incidentId\":\"28282\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"lastActivityDateTime\":\"2021-05-02T07:56:58.222Z\",\"lastUpdateDateTime\":\"2021-05-02T14:19:01.3266667Z\",\"mitreTechniques\":[\"T1564.001\"],\"providerAlertId\":\"da637551227677560813_-961444813\",\"recommendedActions\":\"Collect artifacts and determine scope\\n�\\tReview the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) \\n�\\tLook for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.\\n�\\tSubmit relevant files for deep analysis and review resulting detailed behavioral information.\\n�\\tSubmit undetected files to the MMPC malware portal\\n\\nInitiate containment \\u0026 mitigation \\n�\\tContact the user to verify intent and initiate local remediation actions as needed.\\n�\\tUpdate AV signatures and run a full scan. The scan might reveal and remove previously-undetected malware components.\\n�\\tEnsure that the machine has the latest security updates. In particular, ensure that you have installed the latest software, web browser, and Operating System versions.\\n�\\tIf credential theft is suspected, reset all relevant users passwords.\\n�\\tBlock communication with relevant URLs or IPs at the organization�s perimeter.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"low\",\"status\":\"new\",\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious execution of hidden file\"},\"assignedTo\":\"KaiC@contoso.onmicrosoft.com\",\"classification\":\"truePositive\",\"comments\":[{\"comment\":\"Demo incident\",\"createdBy\":\"DavidS@contoso.onmicrosoft.com\",\"createdTime\":\"2021-09-30T12:07:37.2756993Z\"}],\"createdDateTime\":\"2021-08-13T08:43:35.5533333Z\",\"determination\":\"multiStagedAttack\",\"displayName\":\"Multi-stage incident involving Initial access \\u0026 Command and control on multiple endpoints reported by multiple sources\",\"id\":\"2972395\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47\",\"lastUpdateDateTime\":\"2021-09-30T09:35:45.1133333Z\",\"redirectIncidentId\":null,\"severity\":\"medium\",\"status\":\"active\",\"tags\":[\"Demo\"],\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\"}",
         "provider": "microsoftDefenderForEndpoint",
@@ -327,4 +327,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/packages/m365_defender/data_stream/log/sample_event.json b/packages/m365_defender/data_stream/log/sample_event.json
index ea4f249a76a..de47d83f270 100644
--- a/packages/m365_defender/data_stream/log/sample_event.json
+++ b/packages/m365_defender/data_stream/log/sample_event.json
@@ -1,27 +1,27 @@
 {
     "@timestamp": "2020-09-06T12:07:55.32Z",
     "agent": {
-        "ephemeral_id": "ec3d7681-6c8e-4b8c-a808-6f632687f2ad",
-        "id": "a588bfad-b81a-4554-968a-cb8de7d78d90",
-        "name": "elastic-agent-14529",
+        "ephemeral_id": "571b38ef-95af-4907-bf8c-d71e58ceab1c",
+        "id": "912deb3a-7d2a-4182-ae54-60cfe94346f0",
+        "name": "elastic-agent-92686",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "provider": "azure"
     },
     "data_stream": {
         "dataset": "m365_defender.log",
-        "namespace": "94775",
+        "namespace": "88195",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "a588bfad-b81a-4554-968a-cb8de7d78d90",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "912deb3a-7d2a-4182-ae54-60cfe94346f0",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": "InitialAccess",
@@ -34,7 +34,7 @@
         "duration": 0,
         "end": "2020-09-06T12:04:00Z",
         "id": "faf8edc936-85f8-a603-b800-08d8525cf099",
-        "ingested": "2024-08-12T16:02:18Z",
+        "ingested": "2025-03-19T06:26:39Z",
         "kind": "alert",
         "original": "{\"alerts\":{\"actorName\":null,\"alertId\":\"faf8edc936-85f8-a603-b800-08d8525cf099\",\"assignedTo\":\"Automation\",\"category\":\"InitialAccess\",\"classification\":null,\"creationTime\":\"2020-09-06T12:07:54.3716642Z\",\"description\":\"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.2\",\"detectionSource\":\"OfficeATP\",\"determination\":null,\"devices\":[],\"entities\":{\"aadUserId\":null,\"accountName\":null,\"clusterBy\":null,\"deliveryAction\":null,\"deviceId\":null,\"domainName\":null,\"entityType\":\"MailBox\",\"fileName\":null,\"filePath\":null,\"ipAddress\":null,\"mailboxAddress\":\"testUser3@contoso.com\",\"mailboxDisplayName\":\"test User3\",\"parentProcessCreationTime\":null,\"parentProcessId\":null,\"processCommandLine\":null,\"processCreationTime\":null,\"processId\":null,\"recipient\":null,\"registryHive\":null,\"registryKey\":null,\"registryValue\":null,\"registryValueType\":null,\"securityGroupId\":null,\"securityGroupName\":null,\"sender\":null,\"sha1\":null,\"sha256\":null,\"subject\":null,\"url\":null,\"userPrincipalName\":\"testUser3@contoso.com\",\"userSid\":null},\"firstActivity\":\"2020-09-06T12:04:00Z\",\"incidentId\":924518,\"investigationId\":null,\"investigationState\":\"Queued\",\"lastActivity\":\"2020-09-06T12:04:00Z\",\"lastUpdatedTime\":\"2020-09-06T12:37:40.88Z\",\"mitreTechniques\":[],\"resolvedTime\":null,\"serviceSource\":\"OfficeATP\",\"severity\":\"Informational\",\"status\":\"InProgress\",\"threatFamilyName\":null,\"title\":\"Email reported by user as malware or phish\"},\"assignedTo\":null,\"classification\":\"Unknown\",\"comments\":[],\"createdTime\":\"2020-09-06T12:07:55.1366667Z\",\"determination\":\"NotAvailable\",\"incidentId\":924518,\"incidentName\":\"Email reported by user as malware or phish\",\"lastUpdateTime\":\"2020-09-06T12:07:55.32Z\",\"redirectIncidentId\":null,\"severity\":\"Informational\",\"status\":\"Active\",\"tags\":[]}",
         "provider": "OfficeATP",
@@ -106,4 +106,4 @@
     "user": {
         "name": "testUser3@contoso.com"
     }
-}
\ No newline at end of file
+}
diff --git a/packages/m365_defender/docs/README.md b/packages/m365_defender/docs/README.md
index 1ed475a5fbe..3a80bbb9373 100644
--- a/packages/m365_defender/docs/README.md
+++ b/packages/m365_defender/docs/README.md
@@ -93,11 +93,11 @@ An example event for `alert` looks as following:
 {
     "@timestamp": "2023-10-20T09:54:07.503Z",
     "agent": {
-        "ephemeral_id": "5047ff1c-c1ac-4b5f-aaff-47aee13c110b",
-        "id": "54d960cc-1254-43af-8389-292d7627367d",
-        "name": "elastic-agent-15120",
+        "ephemeral_id": "751bd2a5-401a-4045-83ac-932ff4e2399f",
+        "id": "9a796a20-b8fb-4412-a3f1-cdf338987906",
+        "name": "elastic-agent-64558",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "account": {
@@ -106,16 +106,16 @@ An example event for `alert` looks as following:
     },
     "data_stream": {
         "dataset": "m365_defender.alert",
-        "namespace": "14786",
+        "namespace": "82773",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "54d960cc-1254-43af-8389-292d7627367d",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "9a796a20-b8fb-4412-a3f1-cdf338987906",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": [
@@ -133,7 +133,7 @@ An example event for `alert` looks as following:
         "duration": 2478000000,
         "end": "2023-10-20T09:51:41.993Z",
         "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1",
-        "ingested": "2024-08-12T16:00:30Z",
+        "ingested": "2025-03-19T06:25:01Z",
         "kind": "alert",
         "original": "{\"actorDisplayName\":null,\"additionalData\":null,\"alertPolicyId\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"assignedTo\":null,\"category\":\"Execution\",\"classification\":null,\"comments\":[],\"createdDateTime\":\"2023-10-20T09:53:09.8839373Z\",\"description\":\"A suspicious PowerShell activity was observed on the machine. \\nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.\",\"detectionSource\":\"microsoftDefenderForEndpoint\",\"detectorId\":\"7f1c3609-a3ff-40e2-995b-c01770161d68\",\"determination\":null,\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":\"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"defenderAvStatus\":\"notSupported\",\"detailedRoles\":[\"PrimaryDevice\"],\"deviceDnsName\":\"clw555test\",\"firstSeenDateTime\":\"2023-10-20T09:50:17.7383987Z\",\"healthStatus\":\"inactive\",\"ipInterfaces\":[\"192.168.5.65\",\"fe80::cfe4:80b:615c:38fb\",\"127.0.0.1\",\"::1\"],\"loggedOnUsers\":[{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\"}],\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22621,\"osPlatform\":\"Windows11\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"high\",\"roles\":[],\"tags\":[],\"verdict\":\"unknown\",\"version\":\"22H2\",\"vmMetadata\":null},{\"@odata.type\":\"#microsoft.graph.security.userEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"azureAdUserId\":null,\"displayName\":null,\"domainName\":\"AzureAD\",\"userPrincipalName\":null,\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.urlEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"url\":\"http://127.0.0.1/1.exe\",\"verdict\":\"suspicious\"},{\"@odata.type\":\"#microsoft.graph.security.ipEvidence\",\"countryLetterCode\":null,\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"ipAddress\":\"127.0.0.1\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"suspicious\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"detailedRoles\":[],\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"powershell.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":491520,\"issuer\":null,\"sha1\":\"a72c41316307889e43fe8605a0dca4a72e72a011\",\"sha256\":\"d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80\",\"signer\":null},\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"parentProcessCreationDateTime\":\"2023-10-20T09:51:19.5064237Z\",\"parentProcessId\":5772,\"parentProcessImageFile\":{\"fileName\":\"cmd.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":323584,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"powershell.exe  -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe');Start-Process 'C:\\\\\\\\test-WDATP-test\\\\\\\\invoice.exe'\",\"processCreationDateTime\":\"2023-10-20T09:51:39.4997961Z\",\"processId\":8224,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"CDPUserIS-38411\",\"azureAdUserId\":null,\"displayName\":null,\"domainName\":\"AzureAD\",\"userPrincipalName\":null,\"userSid\":\"S-1-12-1-1485667349-1150190949-4065799612-2328216759\"},\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2023-10-20T09:51:39.5154802Z\",\"id\":\"daefa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"incidentId\":\"23\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"lastActivityDateTime\":\"2023-10-20T09:51:41.9939003Z\",\"lastUpdateDateTime\":\"2023-10-20T09:54:07.5033333Z\",\"mitreTechniques\":[\"T1059.001\"],\"productName\":\"Microsoft Defender for Endpoint\",\"providerAlertId\":\"efa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"recommendedActions\":\"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\\n2. Search the script for more indicators to investigate - for example IP addresses (potential C\\u0026C servers), target computers etc.\\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"medium\",\"status\":\"new\",\"tenantId\":\"3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious PowerShell command line\"}",
         "provider": "microsoftDefenderForEndpoint",
@@ -909,11 +909,11 @@ An example event for `incident` looks as following:
 {
     "@timestamp": "2021-09-30T09:35:45.113Z",
     "agent": {
-        "ephemeral_id": "cd25528a-43c2-4c2b-9dfd-f46ec8044067",
-        "id": "d0cc4e5a-22d2-441c-b3e3-b77013785358",
-        "name": "elastic-agent-63564",
+        "ephemeral_id": "fe161e56-e2bb-430b-8e88-deaa344fd902",
+        "id": "780e6db9-8212-48d3-afa0-561b61606506",
+        "name": "elastic-agent-28930",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "account": {
@@ -925,16 +925,16 @@ An example event for `incident` looks as following:
     },
     "data_stream": {
         "dataset": "m365_defender.incident",
-        "namespace": "13281",
+        "namespace": "60062",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "d0cc4e5a-22d2-441c-b3e3-b77013785358",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "780e6db9-8212-48d3-afa0-561b61606506",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": [
@@ -944,7 +944,7 @@ An example event for `incident` looks as following:
         "created": "2021-08-13T08:43:35.553Z",
         "dataset": "m365_defender.incident",
         "id": "2972395",
-        "ingested": "2024-08-12T16:01:29Z",
+        "ingested": "2025-03-19T06:25:50Z",
         "kind": "alert",
         "original": "{\"@odata.type\":\"#microsoft.graph.security.incident\",\"alerts\":{\"@odata.type\":\"#microsoft.graph.security.alert\",\"actorDisplayName\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"assignedTo\":null,\"category\":\"DefenseEvasion\",\"classification\":\"unknown\",\"comments\":[],\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"description\":\"A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.\",\"detectionSource\":\"antivirus\",\"detectorId\":\"e0da400f-affd-43ef-b1d5-afc2eb6f2756\",\"determination\":\"unknown\",\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":null,\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"defenderAvStatus\":\"unknown\",\"deviceDnsName\":\"tempDns\",\"firstSeenDateTime\":\"2020-09-12T07:28:32.4321753Z\",\"healthStatus\":\"active\",\"loggedOnUsers\":[],\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22424,\"osPlatform\":\"Windows10\",\"rbacGroupId\":75,\"rbacGroupName\":\"UnassignedGroup\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"medium\",\"roles\":[\"compromised\"],\"tags\":[\"Test Machine\"],\"verdict\":\"unknown\",\"version\":\"Other\",\"vmMetadata\":{\"cloudProvider\":\"azure\",\"resourceId\":\"/subscriptions/8700d3a3-3bb7-4fbe-a090-488a1ad04161/resourceGroups/WdatpApi-EUS-STG/providers/Microsoft.Compute/virtualMachines/NirLaviTests\",\"subscriptionId\":\"8700d3a3-3bb7-4fbe-a090-488a1ad04161\",\"vmId\":\"ca1b0d41-5a3b-4d95-b48b-f220aed11d78\"}},{\"@odata.type\":\"#microsoft.graph.security.fileEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"fileDetails\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"parentProcessCreationDateTime\":\"2021-08-12T07:39:09.0909239Z\",\"parentProcessId\":668,\"parentProcessImageFile\":{\"fileName\":\"services.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":731744,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"\\\"MsSense.exe\\\"\",\"processCreationDateTime\":\"2021-08-12T12:43:19.0772577Z\",\"processId\":4780,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"SYSTEM\",\"azureAdUserId\":null,\"domainName\":\"NT AUTHORITY\",\"userPrincipalName\":null,\"userSid\":\"S-1-5-18\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.registryKeyEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"registryHive\":\"HKEY_LOCAL_MACHINE\",\"registryKey\":\"SYSTEM\\\\CONTROLSET001\\\\CONTROL\\\\WMI\\\\AUTOLOGGER\\\\SENSEAUDITLOGGER\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2021-04-26T07:45:50.116Z\",\"id\":\"da637551227677560813_-961444813\",\"incidentId\":\"28282\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"lastActivityDateTime\":\"2021-05-02T07:56:58.222Z\",\"lastUpdateDateTime\":\"2021-05-02T14:19:01.3266667Z\",\"mitreTechniques\":[\"T1564.001\"],\"providerAlertId\":\"da637551227677560813_-961444813\",\"recommendedActions\":\"Collect artifacts and determine scope\\n�\\tReview the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) \\n�\\tLook for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.\\n�\\tSubmit relevant files for deep analysis and review resulting detailed behavioral information.\\n�\\tSubmit undetected files to the MMPC malware portal\\n\\nInitiate containment \\u0026 mitigation \\n�\\tContact the user to verify intent and initiate local remediation actions as needed.\\n�\\tUpdate AV signatures and run a full scan. The scan might reveal and remove previously-undetected malware components.\\n�\\tEnsure that the machine has the latest security updates. In particular, ensure that you have installed the latest software, web browser, and Operating System versions.\\n�\\tIf credential theft is suspected, reset all relevant users passwords.\\n�\\tBlock communication with relevant URLs or IPs at the organization�s perimeter.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"low\",\"status\":\"new\",\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious execution of hidden file\"},\"assignedTo\":\"KaiC@contoso.onmicrosoft.com\",\"classification\":\"truePositive\",\"comments\":[{\"comment\":\"Demo incident\",\"createdBy\":\"DavidS@contoso.onmicrosoft.com\",\"createdTime\":\"2021-09-30T12:07:37.2756993Z\"}],\"createdDateTime\":\"2021-08-13T08:43:35.5533333Z\",\"determination\":\"multiStagedAttack\",\"displayName\":\"Multi-stage incident involving Initial access \\u0026 Command and control on multiple endpoints reported by multiple sources\",\"id\":\"2972395\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47\",\"lastUpdateDateTime\":\"2021-09-30T09:35:45.1133333Z\",\"redirectIncidentId\":null,\"severity\":\"medium\",\"status\":\"active\",\"tags\":[\"Demo\"],\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\"}",
         "provider": "microsoftDefenderForEndpoint",
@@ -1455,27 +1455,27 @@ An example event for `log` looks as following:
 {
     "@timestamp": "2020-09-06T12:07:55.32Z",
     "agent": {
-        "ephemeral_id": "ec3d7681-6c8e-4b8c-a808-6f632687f2ad",
-        "id": "a588bfad-b81a-4554-968a-cb8de7d78d90",
-        "name": "elastic-agent-14529",
+        "ephemeral_id": "571b38ef-95af-4907-bf8c-d71e58ceab1c",
+        "id": "912deb3a-7d2a-4182-ae54-60cfe94346f0",
+        "name": "elastic-agent-92686",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.18.0"
     },
     "cloud": {
         "provider": "azure"
     },
     "data_stream": {
         "dataset": "m365_defender.log",
-        "namespace": "94775",
+        "namespace": "88195",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "a588bfad-b81a-4554-968a-cb8de7d78d90",
-        "snapshot": false,
-        "version": "8.14.3"
+        "id": "912deb3a-7d2a-4182-ae54-60cfe94346f0",
+        "snapshot": true,
+        "version": "8.18.0"
     },
     "event": {
         "action": "InitialAccess",
@@ -1488,7 +1488,7 @@ An example event for `log` looks as following:
         "duration": 0,
         "end": "2020-09-06T12:04:00Z",
         "id": "faf8edc936-85f8-a603-b800-08d8525cf099",
-        "ingested": "2024-08-12T16:02:18Z",
+        "ingested": "2025-03-19T06:26:39Z",
         "kind": "alert",
         "original": "{\"alerts\":{\"actorName\":null,\"alertId\":\"faf8edc936-85f8-a603-b800-08d8525cf099\",\"assignedTo\":\"Automation\",\"category\":\"InitialAccess\",\"classification\":null,\"creationTime\":\"2020-09-06T12:07:54.3716642Z\",\"description\":\"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.2\",\"detectionSource\":\"OfficeATP\",\"determination\":null,\"devices\":[],\"entities\":{\"aadUserId\":null,\"accountName\":null,\"clusterBy\":null,\"deliveryAction\":null,\"deviceId\":null,\"domainName\":null,\"entityType\":\"MailBox\",\"fileName\":null,\"filePath\":null,\"ipAddress\":null,\"mailboxAddress\":\"testUser3@contoso.com\",\"mailboxDisplayName\":\"test User3\",\"parentProcessCreationTime\":null,\"parentProcessId\":null,\"processCommandLine\":null,\"processCreationTime\":null,\"processId\":null,\"recipient\":null,\"registryHive\":null,\"registryKey\":null,\"registryValue\":null,\"registryValueType\":null,\"securityGroupId\":null,\"securityGroupName\":null,\"sender\":null,\"sha1\":null,\"sha256\":null,\"subject\":null,\"url\":null,\"userPrincipalName\":\"testUser3@contoso.com\",\"userSid\":null},\"firstActivity\":\"2020-09-06T12:04:00Z\",\"incidentId\":924518,\"investigationId\":null,\"investigationState\":\"Queued\",\"lastActivity\":\"2020-09-06T12:04:00Z\",\"lastUpdatedTime\":\"2020-09-06T12:37:40.88Z\",\"mitreTechniques\":[],\"resolvedTime\":null,\"serviceSource\":\"OfficeATP\",\"severity\":\"Informational\",\"status\":\"InProgress\",\"threatFamilyName\":null,\"title\":\"Email reported by user as malware or phish\"},\"assignedTo\":null,\"classification\":\"Unknown\",\"comments\":[],\"createdTime\":\"2020-09-06T12:07:55.1366667Z\",\"determination\":\"NotAvailable\",\"incidentId\":924518,\"incidentName\":\"Email reported by user as malware or phish\",\"lastUpdateTime\":\"2020-09-06T12:07:55.32Z\",\"redirectIncidentId\":null,\"severity\":\"Informational\",\"status\":\"Active\",\"tags\":[]}",
         "provider": "OfficeATP",
diff --git a/packages/m365_defender/manifest.yml b/packages/m365_defender/manifest.yml
index a3aa4164def..73444c236cb 100644
--- a/packages/m365_defender/manifest.yml
+++ b/packages/m365_defender/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.2.3"
 name: m365_defender
 title: Microsoft M365 Defender
-version: "2.24.0"
+version: "2.25.0"
 description: Collect logs from Microsoft M365 Defender with Elastic Agent.
 categories:
   - "security"


Reviews:
user: login: ShourieG
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T11:28:24Z
user: login: ShourieG
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T11:30:05Z
user: login: ShourieG
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T11:38:00Z
user: login: navnit-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T12:11:41Z
user: login: navnit-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T12:19:54Z
user: login: ShourieG
body: LGTM
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-20T07:08:08Z

Review comments:
diff_hunk: @@ -71,6 +71,14 @@ streams:
         type: bool
         multi: false
         default: false
+      - name: include_unknown_enum_members
+        required: true
path: packages/m365_defender/data_stream/alert/manifest.yml
user: login: ShourieG
body: why is this a required field ? 
created_at: 2025-03-19T11:28:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -394,8 +398,8 @@ rules:
                 "severity": "low",
                 "classification": null,
                 "determination": null,
-                "serviceSource": "microsoftDefenderForEndpoint",
-                "detectionSource": "microsoftDefenderForEndpoint",
+                "serviceSource": "microsoftDefenderForCloud",
+                "detectionSource": "microsoftDefenderForCloud",
path: packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml
user: login: ShourieG
body: can you provide some context as to why these changed ?
created_at: 2025-03-19T11:30:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.25.0"
+  changes:
+    - description: Add toggle button for including unknown members for properties of evolvable enum types.
path: packages/m365_defender/changelog.yml
user: login: ShourieG
body: ```suggestion
    - description: Add a toggle button for including unknown members in properties of evolvable enum types.
```
created_at: 2025-03-19T11:37:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -394,8 +398,8 @@ rules:
                 "severity": "low",
                 "classification": null,
                 "determination": null,
-                "serviceSource": "microsoftDefenderForEndpoint",
-                "detectionSource": "microsoftDefenderForEndpoint",
+                "serviceSource": "microsoftDefenderForCloud",
+                "detectionSource": "microsoftDefenderForCloud",
path: packages/m365_defender/_dev/deploy/docker/alert-http-mock-config.yml
user: login: navnit-elastic
body: This is to test with at least one unknown enum member (which, in this case, is `microsoftDefenderForCloud`) in case the 'include unknown member' toggle is enabled.
created_at: 2025-03-19T12:11:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -71,6 +71,14 @@ streams:
         type: bool
         multi: false
         default: false
+      - name: include_unknown_enum_members
+        required: true
path: packages/m365_defender/data_stream/alert/manifest.yml
user: login: navnit-elastic
body: Agree, we can make it optional for unambiguity.
created_at: 2025-03-19T12:19:54Z
author_association: CONTRIBUTOR

PR comments:
user: login: elasticmachine
created_at: 2025-03-19T11:07:40Z
body: Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
author_association: NONE
user: login: elasticmachine
created_at: 2025-03-19T12:48:30Z
body: ## :green_heart: Build Succeeded
* [Buildkite Build](https://buildkite.com/elastic/integrations/builds/23558)
* Commit: 5777ca7bbe514960fef2d7afa1e31870ecfe5b8a

### History
* :green_heart: [Build #23551](https://buildkite.com/elastic/integrations/builds/23551) succeeded 302d5e76f2244dec52b1d198fb91f5d4ac670d14

cc @navnit-elastic

<!--buildkite-pr-comment-integrations
{"builds":[{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23558","number":23558,"commit":"5777ca7bbe514960fef2d7afa1e31870ecfe5b8a"},{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23551","number":23551,"commit":"302d5e76f2244dec52b1d198fb91f5d4ac670d14"}],"number":23558}
buildkite-pr-comment-->
author_association: NONE
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-03-20T09:13:18Z
body: ### :rocket: Benchmarks report




To see the full report comment with `/test benchmark fullreport`
<!--COMMENT_GENERATED_WITH_ID_benchmark-report-->
author_association: NONE
user: login: elastic-sonarqube[bot]
created_at: 2025-03-20T09:13:40Z
body: ## [![Quality Gate passed](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166) **Quality Gate passed**  
Issues  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&resolved=false) [0 New issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&resolved=false)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/fixed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13166) [0 Fixed issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13166)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/accepted-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&issueStatuses=ACCEPTED) [0 Accepted issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&issueStatuses=ACCEPTED)

Measures  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166) [0 Security Hotspots](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&metric=new_coverage&view=list) [100.0% Coverage on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&metric=new_coverage&view=list)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&metric=new_duplicated_lines_density&view=list) [0.0% Duplication on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13166)


author_association: NONE
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-03-20T09:49:04Z
body: Package m365_defender - 2.25.0 containing this change is available at https://epr.elastic.co/package/m365_defender/2.25.0/
author_association: NONE