[O365] Migrate to CEL input

[jamiehynds]

Our O365 integration relies on the O365 Management API input, which is still under a Beta flag. O365 is the only integration leveraging this input and we should look at migrating to the httpjson or cel input as a more suitable alternative. This would avoid us having to maintain and support the o365 input for one integration, and bring the integration inline with our other API based integration.

Questions

1. Are there other integrations using the O365 Management API input?
2. Does moving to httpjson allos us to address [O365] Add support for Microsoft Authentication Library (MSAL) #1868

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[taylor-swanson]

I responded in that other issue, but I believe moving to httpjson would address the underlying issue in #5046.

Regarding question 2 above, the answer should be "yes". If I'm understanding it correctly, MSAL should be compatible with OAuth v2.0, which is what httpjson is capable of using.

[narph]

Look into

• updating the current data stream.
• check access to the API
• Tag events that come from a filestream with take_over: true beats#34894
• potentially moving to CEL once is GA

[kcreddy]

Since we are going to use cel input as longterm solution, we are going to attempt to convert it to cel input instead of httpjson and find any caveats of doing it.

[kcreddy]

The screenshots of user experience while setting up the new input is provided here - #6621 (comment)