- Fix issue with m365_defender, when parsing incidents that has no alerts attached: {pull}25421[25421]

- Improve inode reuse handling by removing state for removed files more eagerly from the internal state table in the logs inputs. {pull}25756[25756]

- Fix default config template values for paths on oracle module: {pull}26276[26276]

- Do not close filestream harvester if an unexpected error is returned when close.on_state_change.* is enabled. {pull}26411[26411]

*Filebeat*

- Fix incorrect field name appending to `related.hash` in `threatintel.abusechmalware` ingest pipeline. {issue}25151[25151] {pull}25674[25674]

- Add improvements to the azure activitylogs and platformlogs ingest pipelines. {pull}26148[26148]

- Fix `kibana.log` pipeline when `event.duration` calculation becomes a Long. {issue}24556[24556] {pull}25675[25675]

- Removed incorrect `http.request.referrer` field from `aws.elb` module. {issue}26435[26435] {pull}26441[26441]

- Fix `threatintel.indicator.url.full` not being populated. {issue}26351[26351] {pull}26508[26508]

- Fix Elasticsearch compatibility for modules that use `type: ip` with `convert` processors. {issue}26629[26629] {pull}26676[26676]

==== Known Issue

*Journalbeat*