Merge pull request #1392 from SEKOIA-IO/lv/o365_split_email

O365 - parse email for external users
SEKOIA-IO · Dec 13, 2024 · 807b5c0 · 807b5c0
2 parents 346c394 + bd93f92
commit 807b5c0
Show file tree

Hide file tree

Showing 57 changed files with 166 additions and 2 deletions.
diff --git a/Office 365/o365/_meta/fields.yml b/Office 365/o365/_meta/fields.yml
@@ -513,6 +513,11 @@ office365.user_type.code:
   name: office365.user_type.code
   type: long
 
+office365.user_type.is_external:
+  description: Whether user is external
+  name: office365.user_type.is_external
+  type: boolean
+
 office365.user_type.name:
   description: The translated type of the user that performed the operation
   name: office365.user_type.name

diff --git a/Office 365/o365/ingest/parser.yml b/Office 365/o365/ingest/parser.yml
@@ -77,7 +77,7 @@ stages:
           event.action: "{{json_event.message.Operation}}"
           event.code: "{{json_event.message.RecordType | string}}"
           event.reason: "{{json_event.message.ActionName}}"
-          user.name: "{{json_event.message.UserId}}"
+          user.name: "{{json_event.message.UserId.removeprefix('urn:spo:guest#')}}"
           user.id: "{{json_event.message.UserKey}}"
           organization.id: "{{json_event.message.OrganizationId}}"
           action.id: "{{json_event.message.RecordType}}"
@@ -89,9 +89,12 @@ stages:
         filter: "{{parse_client_ip.result.ip | is_ipaddress}}"
 
       - set:
-          user.email: "{{json_event.message.UserId}}"
+          user.email: "{{json_event.message.UserId.removeprefix('urn:spo:guest#')}}"
         filter: '{{"@" in json_event.message.UserId}}'
 
+      - set:
+          office365.user_type.is_external: "{{'urn:spo:guest#' in json_event.message.UserId}}"
+
       - set:
           source.ip: "{{parse_client_ip_address.result.ip}}"
           source.port: "{{parse_client_ip_address.result.port}}"

diff --git a/Office 365/o365/tests/ad.json b/Office 365/o365/tests/ad.json
@@ -44,6 +44,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/ad_1.json b/Office 365/o365/tests/ad_1.json
@@ -53,6 +53,7 @@
       "result_status": "Success",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/add_member_to_role.json b/Office 365/o365/tests/add_member_to_role.json
@@ -57,6 +57,7 @@
       "result_status": "Success",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/automated_investigation_and_response.json b/Office 365/o365/tests/automated_investigation_and_response.json
@@ -50,6 +50,7 @@
       "record_type": 64,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/automated_investigation_and_response_1.json b/Office 365/o365/tests/automated_investigation_and_response_1.json
@@ -145,6 +145,7 @@
       "record_type": 64,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/automated_investigation_and_response_with_additional_fields.json b/Office 365/o365/tests/automated_investigation_and_response_with_additional_fields.json
@@ -95,6 +95,7 @@
       "record_type": 64,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/automated_investigation_and_response_with_additional_fields_1.json b/Office 365/o365/tests/automated_investigation_and_response_with_additional_fields_1.json
@@ -121,6 +121,7 @@
       "record_type": 64,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/automated_investigation_and_response_with_attachment.json b/Office 365/o365/tests/automated_investigation_and_response_with_attachment.json
@@ -108,6 +108,7 @@
       "record_type": 64,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/browser_log.json b/Office 365/o365/tests/browser_log.json
@@ -29,6 +29,7 @@
       "record_type": 36,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/clientipadress.json b/Office 365/o365/tests/clientipadress.json
@@ -38,6 +38,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 5,
+        "is_external": false,
         "name": "Application"
       }
     },

diff --git a/Office 365/o365/tests/compliancemanager-scorechange.json b/Office 365/o365/tests/compliancemanager-scorechange.json
@@ -22,6 +22,7 @@
       "result_status": "Successful",
       "user_type": {
         "code": 2,
+        "is_external": false,
         "name": "Admin"
       }
     },

diff --git a/Office 365/o365/tests/email_reported.json b/Office 365/o365/tests/email_reported.json
@@ -39,6 +39,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/exchange_event1.json b/Office 365/o365/tests/exchange_event1.json
@@ -39,6 +39,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/exchange_item_aggregated.json b/Office 365/o365/tests/exchange_item_aggregated.json
@@ -30,6 +30,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/exchange_item_group.json b/Office 365/o365/tests/exchange_item_group.json
@@ -40,6 +40,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/exchange_item_group_2.json b/Office 365/o365/tests/exchange_item_group_2.json
@@ -93,6 +93,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/exchange_item_update.json b/Office 365/o365/tests/exchange_item_update.json
@@ -41,6 +41,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/external_user.json b/Office 365/o365/tests/external_user.json
@@ -0,0 +1,102 @@
+{
+  "input": {
+    "message": "{\"AppAccessContext\": {\"ClientAppName\": \"MeTA\", \"CorrelationId\": \"27de65c0-1c43-4d70-9a4d-45a66418dbd6\"}, \"CreationTime\": \"2024-11-29T12:31:12\", \"Id\": \"609745a8-8ec0-4305-8607-fa95f45cf370\", \"Operation\": \"FileDownloaded\", \"OrganizationId\": \"eda474c4-ddfd-4ecd-85ff-3103a09b118d\", \"RecordType\": 6, \"UserKey\": \"urn:spo:guest:hash#aGVsbG8gdGhlcmUK\", \"UserType\": 0, \"Version\": 1, \"Workload\": \"OneDrive\", \"ClientIP\": \"1.2.3.4\", \"UserId\": \"urn:spo:guest#[email protected]\", \"AuthenticationType\": \"OAuth\", \"BrowserName\": \"\", \"BrowserVersion\": \"\", \"CorrelationId\": \"27de65c0-1c43-4d70-9a4d-45a66418dbd6\", \"DoNotDistributeEvent\": true, \"EventSource\": \"SharePoint\", \"GeoLocation\": \"EUR\", \"IsManagedDevice\": false, \"ItemType\": \"File\", \"ListId\": \"56391ee5-91aa-44f9-810e-a5dc47abbb02\", \"ListItemUniqueId\": \"1d91eda8-2918-42f0-8f2b-88dd9aaffcdf\", \"Platform\": \"Service\", \"Site\": \"582d798a-ba87-4a78-8792-87db9262b0a3\", \"UserAgent\": \"OneDriveMpc-Transform_Zip/1.0\", \"UserSessionId\": \"b332294a-fad5-45a0-8761-63922a2544bf\", \"WebId\": \"ead1e78b-1d0c-4251-920a-f4fb48fce5e2\", \"DeviceDisplayName\": \"5.6.7.8\", \"EventSignature\": \"SOME_SIGNATURE\", \"FileSizeBytes\": 26860827, \"HighPriorityMediaProcessing\": false, \"ListBaseType\": 1, \"ListServerTemplate\": 700, \"SourceFileExtension\": \"zip\", \"ZipFileName\": \"1.zip\", \"SiteUrl\": \"https://example.com/\", \"SourceRelativeUrl\": \"Documents/IMT MBA\", \"SourceFileName\": \"1.zip\", \"ApplicationDisplayName\": \"MeTA\", \"ObjectId\": \"https://example.com/1.zip\"}"
+  },
+  "expected": {
+    "message": "{\"AppAccessContext\": {\"ClientAppName\": \"MeTA\", \"CorrelationId\": \"27de65c0-1c43-4d70-9a4d-45a66418dbd6\"}, \"CreationTime\": \"2024-11-29T12:31:12\", \"Id\": \"609745a8-8ec0-4305-8607-fa95f45cf370\", \"Operation\": \"FileDownloaded\", \"OrganizationId\": \"eda474c4-ddfd-4ecd-85ff-3103a09b118d\", \"RecordType\": 6, \"UserKey\": \"urn:spo:guest:hash#aGVsbG8gdGhlcmUK\", \"UserType\": 0, \"Version\": 1, \"Workload\": \"OneDrive\", \"ClientIP\": \"1.2.3.4\", \"UserId\": \"urn:spo:guest#[email protected]\", \"AuthenticationType\": \"OAuth\", \"BrowserName\": \"\", \"BrowserVersion\": \"\", \"CorrelationId\": \"27de65c0-1c43-4d70-9a4d-45a66418dbd6\", \"DoNotDistributeEvent\": true, \"EventSource\": \"SharePoint\", \"GeoLocation\": \"EUR\", \"IsManagedDevice\": false, \"ItemType\": \"File\", \"ListId\": \"56391ee5-91aa-44f9-810e-a5dc47abbb02\", \"ListItemUniqueId\": \"1d91eda8-2918-42f0-8f2b-88dd9aaffcdf\", \"Platform\": \"Service\", \"Site\": \"582d798a-ba87-4a78-8792-87db9262b0a3\", \"UserAgent\": \"OneDriveMpc-Transform_Zip/1.0\", \"UserSessionId\": \"b332294a-fad5-45a0-8761-63922a2544bf\", \"WebId\": \"ead1e78b-1d0c-4251-920a-f4fb48fce5e2\", \"DeviceDisplayName\": \"5.6.7.8\", \"EventSignature\": \"SOME_SIGNATURE\", \"FileSizeBytes\": 26860827, \"HighPriorityMediaProcessing\": false, \"ListBaseType\": 1, \"ListServerTemplate\": 700, \"SourceFileExtension\": \"zip\", \"ZipFileName\": \"1.zip\", \"SiteUrl\": \"https://example.com/\", \"SourceRelativeUrl\": \"Documents/IMT MBA\", \"SourceFileName\": \"1.zip\", \"ApplicationDisplayName\": \"MeTA\", \"ObjectId\": \"https://example.com/1.zip\"}",
+    "event": {
+      "action": "FileDownloaded",
+      "category": [
+        "file"
+      ],
+      "code": "6",
+      "outcome": "success",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2024-11-29T12:31:12Z",
+    "action": {
+      "id": 6,
+      "name": "FileDownloaded",
+      "outcome": "success",
+      "properties": [
+        {
+          "SiteUrl": "https://example.com/",
+          "SourceFileName": "1.zip",
+          "SourceRelativeUrl": "Documents/IMT MBA",
+          "UserAgent": "OneDriveMpc-Transform_Zip/1.0"
+        }
+      ],
+      "target": "user"
+    },
+    "file": {
+      "directory": "Documents/IMT MBA",
+      "extension": "zip",
+      "name": "1.zip",
+      "size": 26860827
+    },
+    "office365": {
+      "audit": {
+        "object_id": "https://example.com/1.zip"
+      },
+      "context": {
+        "client": {
+          "name": "MeTA"
+        },
+        "correlation": {
+          "id": "27de65c0-1c43-4d70-9a4d-45a66418dbd6"
+        }
+      },
+      "record_type": 6,
+      "user_type": {
+        "code": 0,
+        "is_external": true,
+        "name": "Regular"
+      }
+    },
+    "organization": {
+      "id": "eda474c4-ddfd-4ecd-85ff-3103a09b118d"
+    },
+    "related": {
+      "ip": [
+        "1.2.3.4"
+      ],
+      "user": [
+        "[email protected]"
+      ]
+    },
+    "service": {
+      "name": "OneDrive"
+    },
+    "source": {
+      "address": "1.2.3.4",
+      "ip": "1.2.3.4"
+    },
+    "url": {
+      "domain": "example.com",
+      "full": "https://example.com/1.zip",
+      "original": "https://example.com/1.zip",
+      "path": "/1.zip",
+      "port": 443,
+      "registered_domain": "example.com",
+      "scheme": "https",
+      "top_level_domain": "com"
+    },
+    "user": {
+      "email": "[email protected]",
+      "id": "urn:spo:guest:hash#aGVsbG8gdGhlcmUK",
+      "name": "[email protected]"
+    },
+    "user_agent": {
+      "device": {
+        "name": "Other"
+      },
+      "name": "Other",
+      "original": "OneDriveMpc-Transform_Zip/1.0",
+      "os": {
+        "name": "Other"
+      }
+    }
+  }
+}
diff --git a/Office 365/o365/tests/file_previewed.json b/Office 365/o365/tests/file_previewed.json
@@ -42,6 +42,7 @@
       "record_type": 6,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/file_size.json b/Office 365/o365/tests/file_size.json
@@ -52,6 +52,7 @@
       "record_type": 6,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/file_sync_download_full.json b/Office 365/o365/tests/file_sync_download_full.json
@@ -48,6 +48,7 @@
       "record_type": 6,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/file_visited.json b/Office 365/o365/tests/file_visited.json
@@ -30,6 +30,7 @@
       "result_status": "TRUE",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/form_log.json b/Office 365/o365/tests/form_log.json
@@ -28,6 +28,7 @@
       },
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/inbox_rule.json b/Office 365/o365/tests/inbox_rule.json
@@ -46,6 +46,7 @@
       "result_status": "True",
       "user_type": {
         "code": 2,
+        "is_external": false,
         "name": "Admin"
       }
     },

diff --git a/Office 365/o365/tests/managed_sync.json b/Office 365/o365/tests/managed_sync.json
@@ -38,6 +38,7 @@
       "record_type": 4,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/mass_download.json b/Office 365/o365/tests/mass_download.json
@@ -39,6 +39,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/mcas_alert.json b/Office 365/o365/tests/mcas_alert.json
@@ -41,6 +41,7 @@
       "result_status": "New",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/microsoft_defender_threatintelligence_atp.json b/Office 365/o365/tests/microsoft_defender_threatintelligence_atp.json
@@ -33,6 +33,7 @@
       "record_type": 47,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/microsoft_defender_threatintelligence_mail.json b/Office 365/o365/tests/microsoft_defender_threatintelligence_mail.json
@@ -114,6 +114,7 @@
       "record_type": 28,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/microsoft_defender_threatintelligence_url_click.json b/Office 365/o365/tests/microsoft_defender_threatintelligence_url_click.json
@@ -21,6 +21,7 @@
       "record_type": 41,
       "user_type": {
         "code": 4,
+        "is_external": false,
         "name": "System"
       }
     },

diff --git a/Office 365/o365/tests/operation_properties_01.json b/Office 365/o365/tests/operation_properties_01.json
@@ -61,6 +61,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/operation_properties_02.json b/Office 365/o365/tests/operation_properties_02.json
@@ -58,6 +58,7 @@
       "result_status": "Succeeded",
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },

diff --git a/Office 365/o365/tests/power_bi.json b/Office 365/o365/tests/power_bi.json
@@ -23,6 +23,7 @@
       "record_type": 20,
       "user_type": {
         "code": 0,
+        "is_external": false,
         "name": "Regular"
       }
     },