More fixes after trying the simplified api

[jsoriano]

Follow up to #17656, more issues found on tests after trying to use the simplified API in elastic/elastic-package#3307.

In m365_defender and microsoft_defender_cloud the mock configuration is fixed for the correct refresh token url.
Variables were not correctly set with previous implementation of elastic-package and it looks like the wrong refresh was never tried, so it was silently ignored.

The test in ti_abusetech was actually missing a required variable.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package m365_defender 👍(4) 💚(2) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
incident	1100.11	867.08	-233.03 (-21.18%)	💔
vulnerability	12195.12	8058.02	-4137.1 (-33.92%)	💔

To see the full report comment with /test benchmark fullreport

[mrodm]

LGTM

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

The mock config changes for OAuth2 v2.0 refresh token endpoint and the ti_abusech auth_key addition look correct.

One additional file may need the same fix:

packages/m365_defender/_dev/deploy/docker/vulnerability-http-mock-config.yml (lines 12-22) still uses the old /tenant_id/oauth2/token path and includes the Authorization: Basic header for the refresh token rule, which appears to be the same pattern being fixed in the alert and incident mock configs. Consider whether this file should also be updated for consistency.

---

Why is Claude responding? | Type @claude to interact further

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 34faadc

History

• 💚 Build #39232 succeeded 0e0f3cc

cc @jsoriano

[jsoriano]

@claude

packages/m365_defender/_dev/deploy/docker/vulnerability-http-mock-config.yml (lines 12-22) still uses the old /tenant_id/oauth2/token path and includes the Authorization: Basic header for the refresh token rule, which appears to be the same pattern being fixed in the alert and incident mock configs. Consider whether this file should also be updated for consistency.

You are right that this config looks also incorrect, but it is not failing at the moment with main or with the changes in elastic/elastic-package#3307, so I would leave it as is by now.

[github-actions]

Claude finished @jsoriano's task in 23s —— View job

---

Acknowledging Your Response

• Understand the context
• Review the response and provide acknowledgment

Understood! That's a reasonable approach. I can confirm looking at vulnerability-http-mock-config.yml that lines 12-22 do indeed have the inconsistent pattern (using /tenant_id/oauth2/token with Authorization: Basic header), but since the tests are passing both on main and with the elastic-package changes, it makes sense to keep this PR focused on the failing cases only.

If the vulnerability tests start failing in the future due to this inconsistency, it can be addressed in a separate PR at that time.

---

---

Why is Claude responding? | Type @claude to interact further

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.