| 1 | filebeat.modules: |
| 2 | - module: microsoft |
| 3 | defender_atp: |
| 4 | enabled: true |
| 5 | var.oauth2.client.id: "REPLACE_CLIENT_ID" |
| 6 | var.oauth2.client.secret: "REPLACE_CLIENT_SECRET" |
| 7 | var.oauth2.token_url: "https://login.microsoftonline.com/REPLACE_TENANT_ID/oauth2/token" |
| 8 | |
| 9 | filebeat.inputs: |
| 10 | - type: log |
| 11 | enabled: false |
| 12 | paths: |
| 13 | - /var/log/*.log |
| 14 | |
| 15 | output.logstash: |
| 16 | hosts: ["REPLACE_SYSLOG_HOST:REPLACE_SYSLOG_PORT"] |