OAuth2 APIs

[Skypex]

Hello,

I currently want to fetch data from Windows Defender APT using a REST API provided by Microsoft.
Here is how the API works: Pull Microsoft Defender ATP alerts using SIEM REST API

However, this API uses OAuth2 for authentication/authorization and this means I need to fetch an new access token e.g. every hour. As the token is part of the request this would mean I need to reconfigure Logstash every hour as well to update it to the new token.

Is there a way to make Logstash managing the tokens?

[dan-drl]

I also would be interested in seeing some kind of oauth2 support. I have similar use case and would like to pull data out of Microsoft Graph REST APIs.

As more and more REST APIs move towards OAuth2, support for this standard in the http_poller plugin seems very important. IMAP is being deprecated for Microsoft's exchange web server (which relies on basic auth in this case), and users are going to need to transition to using OAuth2 and Microsoft's REST APIs.

https://developer.microsoft.com/en-us/office/blogs/end-of-support-for-basic-authentication-access-to-exchange-online-apis-for-office-365-customers/