Filebeat module for Microsoft Defender help

[intsec]

I have reviewed the setup configuration for Microsoft module here. https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-microsoft.html. When I put all my information in I receive this in the filebeat logs:

2022-10-05T15:06:00.914Z ERROR instance/beat.go:1014 Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: at least one of token_url or tenant_id must be provided accessing 'auth.oauth2'

The token_url is in the configuration and I have no idea why it thinks it is not. Has anyone set this up?

[intsec]

Anyone have any luck getting Defender ATP logs from Microsoft? I currently have the Azure logs working but this one is giving me problems.

[intsec]

I do this in my forward node? I have it setup in the manager as well as my Azure connection which is working. With that the config you gave me is exactly how I have it setup.

[Jaap79]

Hi,

you should put it into the /opt/so/saltstack/local/pillar/minions/sensornode_sensor.yml file.

Don’t forget to restart Filebeat on the sensor node as well.

One thing I did think of just now: I also use the O365 integration in the same .yml file and there is a tenant_id: “abcdefghijk” entry there as well..

[intsec]

Still having issues. This seems like a new error but I get this now in filebeat logs.
server responded with status code 401: {"error":{"code":"Unauthorized","message":"Invalid Authorization payload.

[Jaap79]

@intsec Could it be that you mixed up the Secret ID and Secret Value? Happened to me once (but the error suggested that as well, along those lines..)..if that's correct I wouldn't be able to say what's going wrong...

[intsec]

I have verified this in previous attempts to fix this but I will look again.

[intsec]

@Jaap79 I am at a complete loss. I have configured this thing every way I can and still have configuration issues. My Azure module works great it's the Microsoft one that is giving me headaches. Could you redact your filebeat.yml file for me and let me review how you have yours setup since yours is working? I would appreciate it. Thanks!

[intsec]

Anyone have an idea? I have confirmed that my application information is correct that I created in Azure by doing a CURL to pull the JWT and verifying I see what it can read but when filebeat runs it gives me Invalid Authorization payload errors.

[intsec]

Fixed. Updated from 130 to 182 (with some issues) and it works now.