Skip to content

[Microsoft Exchange Online Message Trace] Use case-insensitive comparison for mailflow direction calculation#19951

Open
moxarth-rathod wants to merge 2 commits into
elastic:mainfrom
moxarth-rathod:microsoft_exchange_online_message_trace-fix
Open

[Microsoft Exchange Online Message Trace] Use case-insensitive comparison for mailflow direction calculation#19951
moxarth-rathod wants to merge 2 commits into
elastic:mainfrom
moxarth-rathod:microsoft_exchange_online_message_trace-fix

Conversation

@moxarth-rathod

Copy link
Copy Markdown
Contributor

Proposed commit message

  microsoft_exchange_online_message_trace: Use case-insensitive comparison for mailflow direction calculation

  This change updates the mailflow direction script to compare source.domain and
  destination.domain against configured local domains case-insensitively using
  equalsIgnoreCase. Microsoft Graph can return sender and recipient domains in mixed
  case , so a case-sensitive match previously misclassifies
  internal mail as external.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

@moxarth-rathod moxarth-rathod self-assigned this Jul 3, 2026
@moxarth-rathod moxarth-rathod requested review from a team as code owners July 3, 2026 06:12
@moxarth-rathod moxarth-rathod added Integration:microsoft_exchange_online_message_trac Microsoft Exchange Online Message Trace bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Jul 3, 2026
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown

✅ All changelog entries have the correct PR link.

@vera-review-bot

Copy link
Copy Markdown

No issues across the latest commits 1006d75.

I'll pick up this PR for review again after 15 minutes.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

cc @moxarth-rathod

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:microsoft_exchange_online_message_trac Microsoft Exchange Online Message Trace Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Microsoft Exchange Online Message Trace]: Lowercase source.domain and destination.domain

1 participant