o365: Set subobjects false to conflict fields

packages/o365/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.15.2"
+  changes:
+    - description: Set subobjects false to `o365.audit.Parameters` and `o365.audit.ModifiedProperties` to avoid mapping conflicts.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/13925
 - version: "2.15.1"
   changes:
     - description: Ensure that empty results do not lead to subsequent invalid API requests.

packages/o365/data_stream/audit/fields/fields.yml

@@ -381,6 +381,12 @@
       type: object
       object_type: keyword
       object_type_mapping_type: '*'
+      subobjects: false
+    - name: ModifiedProperties
+      type: object
+      object_type: keyword
+      object_type_mapping_type: '*'
+      subobjects: false
     - name: Name
       type: keyword
     - name: NetworkMessageId
@@ -437,6 +443,12 @@
       type: object
       object_type: keyword
       object_type_mapping_type: '*'
+      subobjects: false
+    - name: Parameters
+      type: object
+      object_type: keyword
+      object_type_mapping_type: '*'
+      subobjects: false
     - name: PhishConfidenceLevel
       type: keyword
     - name: Platform

packages/o365/docs/README.md

@@ -367,6 +367,7 @@ An example event for `audit` looks as following:
 | o365.audit.Members |  | flattened |
 | o365.audit.MessageDate |  | keyword |
 | o365.audit.MessageTime |  | keyword |
+| o365.audit.ModifiedProperties |  | object |
 | o365.audit.ModifiedProperties.\*.\* |  | object |
 | o365.audit.ModifiedProperties.Role_DisplayName.NewValue |  | keyword |
 | o365.audit.Name |  | keyword |
@@ -387,6 +388,7 @@ An example event for `audit` looks as following:
 | o365.audit.P1SenderDomain |  | keyword |
 | o365.audit.P2Sender |  | keyword |
 | o365.audit.P2SenderDomain |  | keyword |
+| o365.audit.Parameters |  | object |
 | o365.audit.Parameters.\* |  | object |
 | o365.audit.Parameters.AccessRights |  | keyword |
 | o365.audit.Parameters.AllowFederatedUsers |  | keyword |

packages/o365/manifest.yml

@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft Office 365
-version: "2.15.1"
+version: "2.15.2"
 description: Collect logs from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.2.3"