[Microsoft Defender XDR] Add support for cloud events

[moxarth-rathod]

Proposed commit message

m365_defender: add support for cloud events tables

This extends the integration to handle CloudAuditEvents, CloudProcessEvents, 
and CloudStorageAggregatedEvents tables from  the Microsoft 365 Defender Advanced Hunting API,
enabling comprehensive monitoring of cloud infrastructure activities, 
process executions, and storage operations.

Test logs were generated based on documentation.

API documentation:
- CloudAuditEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudauditevents-table
- CloudProcessEvents: https://docs.azure.cn/en-us/azure-monitor/reference/tables/cloudprocessevents
- CloudStorageAggregatedEvents: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudstorageaggregatedevents-table
- Advanced Hunting API: https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/m365_defender directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Relates [Microsoft Defender XDR]: Add support for additional tables in event dataset #17230

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package m365_defender 👍(2) 💚(1) 💔(5)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
incident	1157.41	891.03	-266.38 (-23.02%)	💔
vulnerability	14705.88	6720.43	-7985.45 (-54.3%)	💔
alert	900.09	761.61	-138.48 (-15.39%)	💔
event	725.16	530.79	-194.37 (-26.8%)	💔
vulnerability	14705.88	8547.01	-6158.87 (-41.88%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d936e48

History

• 💚 Build #39169 succeeded 9e00c31
• 💚 Build #39160 succeeded 872d910
• 💚 Build #38987 succeeded 55fe279
• 💚 Build #38981 succeeded bb1d8ee

cc @moxarth-rathod

[elastic-vault-github-plugin-prod]

Package m365_defender - 5.11.0 containing this change is available at https://epr.elastic.co/package/m365_defender/5.11.0/