o365: Fix processing of ModifiedProperties field (#23777) (#23786)

A bug was causing entries for the ModifiedProperties field to be
dropped.

(cherry picked from commit 1f8a2e6)

CHANGELOG.next.asciidoc

@@ -262,6 +262,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix concurrent modification exception in Suricata ingest node pipeline. {pull}23534[23534]
 - Change the `event.created` in Netflow events to be the time the event was created by Filebeat
   to be consistent with ECS. {pull}23094[23094]
+- Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777]
 
 *Heartbeat*
 

x-pack/filebeat/module/o365/audit/config/pipeline.js

@@ -157,7 +157,7 @@ function makeDictFromModifiedPropertyArray(options) {
             if (src[i] == null
                 || (name=src[i].Name) == null
                 || (newValue=src[i].NewValue) == null
-                || (oldValue=src[i].OldValue)) continue;
+                || (oldValue=src[i].OldValue) == null) continue;
             name = validFieldName(name);
             if (name in dict) {
                 if (dict[name].NewValue instanceof Array) {