[microsoft_intune][managed_device] Add microsoft_intune managed_device datastream

[janvi-elastic]

Proposed commit message

The initial release includes managed_device data stream, associated dashboards 
and visualizations.

Microsoft Intune fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from documentation and live data samples, 
which were subsequently sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/microsoft_intune directory.
• Run the following command to run tests.

elastic-package test

Run asset tests for the package
--- Test results for package: microsoft_intune - START ---
╭──────────────────┬────────────────┬───────────┬───────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE          │ DATA STREAM    │ TEST TYPE │ TEST NAME                                                                 │ RESULT │ TIME ELAPSED │
├──────────────────┼────────────────┼───────────┼───────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ microsoft_intune │                │ asset     │ dashboard microsoft_intune-adaf931d-1be6-4394-a046-35e1d1010f9e is loaded │ PASS   │       2.03µs │
│ microsoft_intune │                │ asset     │ search microsoft_intune-5c69302a-2d0c-45c0-b4b5-2fe864383b99 is loaded    │ PASS   │        626ns │
│ microsoft_intune │                │ asset     │ search microsoft_intune-75100327-86d0-44e5-adfb-52ad2c59dec7 is loaded    │ PASS   │        616ns │
│ microsoft_intune │                │ asset     │ search microsoft_intune-c91d6412-560c-49a5-80c8-eca25bc242dc is loaded    │ PASS   │        640ns │
│ microsoft_intune │ managed_device │ asset     │ index_template logs-microsoft_intune.managed_device is loaded             │ PASS   │        500ns │
│ microsoft_intune │ managed_device │ asset     │ ingest_pipeline logs-microsoft_intune.managed_device-0.1.0 is loaded      │ PASS   │        564ns │
╰──────────────────┴────────────────┴───────────┴───────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: microsoft_intune - END   ---
Done
Run pipeline tests for the package
--- Test results for package: microsoft_intune - START ---
╭──────────────────┬────────────────┬───────────┬────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE          │ DATA STREAM    │ TEST TYPE │ TEST NAME                                          │ RESULT │ TIME ELAPSED │
├──────────────────┼────────────────┼───────────┼────────────────────────────────────────────────────┼────────┼──────────────┤
│ microsoft_intune │ managed_device │ pipeline  │ (ingest pipeline warnings test-managed-device.log) │ PASS   │ 374.578263ms │
│ microsoft_intune │ managed_device │ pipeline  │ test-managed-device.log                            │ PASS   │ 198.349246ms │
╰──────────────────┴────────────────┴───────────┴────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: microsoft_intune - END   ---
Done
Run policy tests for the package
--- Test results for package: microsoft_intune - START ---
No test results
--- Test results for package: microsoft_intune - END   ---
Done
Run script tests for the package
--- Test results for package: microsoft_intune - START ---
PKG microsoft_intune
[no test files]
--- Test results for package: microsoft_intune - END ---
Done
Run static tests for the package
--- Test results for package: microsoft_intune - START ---
No test results
--- Test results for package: microsoft_intune - END   ---
Done
Run system tests for the package
--- Test results for package: microsoft_intune - START ---
No test results
--- Test results for package: microsoft_intune - END   ---
Done

Screenshot

Implementation Details

Docs Referred

https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/review-logs-using-azure-monitor

[IOITI]

Hi @janvi-elastic, Any reason why not putting Microsoft Intune in Azure integration package and configure router to capture Intune data ?

[cpascale43]

This looks pretty useful overall, a couple thoughts @janvi-elastic:

• Default timeframe is "Last 15 years" - set to 90 days and update screenshot
• Managed Devices stat tile: Without a comparison a single number doesn't tell a security team much. I think we could replace the "Devices by Compliance State" chart with two metric tiles up top (Compliant vs. Non-Compliant) since this is the core question the dashboard is trying to answer and it's scannable at a glance.

There are also some interesting fields from the sample events that we should consider surfacing more prominently:

• EncryptionStatusString - One of the 3 devices has encryption set to False - this feels like it should be prominently visualized, either as a metric tile or alongside the compliance state breakdown, as it's a core device posture signal
• JailBroken - in a production environment with mobile devices this would matter, it's worth surfacing
• LastContact - the Inventory Details table shows this but it's only visible at the bottom. It would be nice to have some callout for devices that haven't contacted Intune in X days, as stale devices are a common blind spot

[janvi-elastic]

@cpascale43 Regarding Devices by Compliance State, In live logs we are getting Compliant, Noncompliant and Not Evaluated. And in documentation we don't have list of Possible values. So should we remove pie chart and replace it with metrics(Compliant vs Noncompliant) ?

[cpascale43]

Thanks @janvi-elastic, given that there are at least three possible values in live data and the docs don't list all of them, we can keep it as is. Thanks for flagging!

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
, , , 775aafd, , , , , , 699aa72, , , , , , , ,

Please, read and sign the above mentioned agreement if you want to contribute to this project

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: f479323

Failed CI Steps

• :pipeline:⬆️ Upload Pipeline: .buildkite/pipeline.yml

History

• 💔 Build #41167 failed 82cc63c
• 💚 Build #40441 succeeded 408786e
• 💔 Build #40366 failed 408786e
• 💚 Build #39205 succeeded 09ae814

[macroscopeapp]

🟠 High extend/agent-version-conditions.md:25

The YAML example at line 26 is missing a colon after kibana, so kibana becomes a key with no value and version: becomes a sibling of kibana instead of a child. Users who copy this example will get a YAML parsing error.

Suggested change

	conditions:
	kibana
	conditions:
	- kibana
	+ kibana:
	version: '^9.4.0'

🤖 Copy this AI Prompt to have your agent fix this:

In file docs/extend/agent-version-conditions.md around lines 25-26:

The YAML example at line 26 is missing a colon after `kibana`, so `kibana` becomes a key with no value and `version:` becomes a sibling of `kibana` instead of a child. Users who copy this example will get a YAML parsing error.

[janvi-elastic]

Sorry for the noise, raised new PR.