# Module: microsoft
# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.18/filebeat-module-microsoft.html

- module: microsoft
  # ATP configuration
  defender_atp:
    enabled: false
    # How often the API should be polled
    #var.interval: 5m

    # Oauth Client ID
    #var.oauth2.client.id: ""

    # Oauth Client Secret
    #var.oauth2.client.secret: ""

    # Oauth Token URL, should include the tenant ID
    #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token"
  m365_defender:
    enabled: false
    # How often the API should be polled
    #var.interval: 5m

    # Oauth Client ID
    #var.oauth2.client.id: ""

    # Oauth Client Secret
    #var.oauth2.client.secret: ""

    # Oauth Token URL, should include the tenant ID
    #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token"

    # Related scopes, default should be included
    #var.oauth2.scopes:
    #  - "https://api.security.microsoft.com/.default"
