#11810 - Enabling m365_defender with Agentless deployment

[qcorporation]

Parent Ticket:
#11810

Proposed commit message

• Updated the documentation based upon agreed upon language to highlight that the integration now supports Agentless deployment
  

• Upgraded the format_version to latest, 3.2.3

• Updated Kibana version constraints to ^8.18 || ^9.0.0

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

1. Create a new account within Azure and register a new application with the below permissions

  "SecurityAlert.Read.All",
  "SecurityAlert.ReadWrite.All",
  "SecurityIncident.Read.All",
  "SecurityIncident.ReadWrite.All"

Note that Incident.Read.All and Incident.ReadWrite.All was not added as these APIs permissions are not available anymore within the permissions list and the integration has marked as deprecated
2. Fill in the client id, client secret and tenant id and install the integration, only tested API and did NOT setup Azure Event Hub
3. The integration does not fetch past events and only events from the time the integration is installed so I was forced to use msgraph import GraphServiceClient to touch an existing Incident, this allowed the Incident to update it's date field and the data was ingested into ES via Agentless Agent
4. Validated that the incidents that were touched were seen within Elasticsearch/Kibana
5. Validated that agent logs did not show any errors

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[andrewkroh]

LGTM.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9b9ecb3

History

• 💚 Build #22729 succeeded 946b43b

cc @qcorporation

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package m365_defender - 2.24.0 containing this change is available at https://epr.elastic.co/package/m365_defender/2.24.0/