@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 194 lines 8.37 KB
Rendered Raw
1 Documentation provided by [Wazuh](https://documentation.wazuh.com/current/cloud-security/office365/monitoring-office365-activity.html).
2
3 Learn how to monitor your organization's Office 365 activity with Wazuh in this section of our documentation.
4
5 # Monitoring Office 365 Activity
6
7 The `audit log` allows organization admins to quickly review the actions performed by members of your organization. It includes details such as who performed the action, what the action was, and when it was performed.
8 This Wazuh module allows you to collect all the logs from Office 365 using its API. The Office 365 Management Activity API aggregates actions and events into tenant-specific content blobs, which are classified by the type and source of the content they contain.
9
10 **List available content:**
11
12 This operation lists the content currently available for retrieval for the specified content type.
13
14 GET https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/subscriptions/content?contentType={content_type}&startTime={start_time}&endTime={end_time}
15
16 **Retrieving content:**
17
18 To retrieve a content blob, make a GET request against the corresponding content URI that is included in the list of available content.
19
20 GET {content_uri}
21
22 Office 365 API description can be found in this `link <https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference>`\_.
23
24 ### Office 365 API requirements
25
26 For **Wazuh** to successfully connect to the **Office365 API**, an authentication process is required. To do this, we must provide the `tenant_id`, `client_id`, and `client_secret` of the application that we authorize in the organization.
27
28 # Register your app
29
30 To authenticate with the Microsoft identity platform endpoint, you need to register an app in your [Microsoft Azure portal app registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) section. Once there click on **New registration**:
31
32 ![Register your app](/images/office365/0-azure-app-new-registration.png)
33
34 Fill in the name of your app, choose the desired account type and click on the **Register** button:
35
36 ![Register your app](/images/office365/1-azure-wazuh-app-register-application.png)
37
38 The app is now registered, and you can see information about it in its **Overview** section, at this point we can get the `client` and `tenant` IDs:
39
40 ![Register your app](/images/office365/2-azure-wazuh-app-overview.png)
41
42 # Certificates & secrets
43
44 You can generate a password to use during the authentication process. Go to **Certificates & secrets** and click on **New client secret**,
45 then the name and the expiration date of the **New client secret** are requested:
46
47 ![Certificates & secrets](/images/office365/3-azure-wazuh-app-create-password.png)
48
49 Copy and save the value section.
50
51 ![Certificates & secrets](/images/office365/3-azure-wazuh-app-create-password-copy-value.png)
52
53 Make sure you write it down because the UI won’t let you copy it afterward.
54
55 # API permissions
56
57 The application needs specific API permissions to be able to request the Office 365 activity events. In this case, you are looking for permissions related to the `https://manage.office.com` resource.
58
59 To configure the application permissions, go to the **API permissions** page and choose **Add a permission**. Select the **Office 365 Management APIs** and click on **Application permissions**.
60
61 You need to add the following permissions under the **ActivityFeed** group:
62
63 - `ActivityFeed.Read`. Read activity data for your organization.
64
65 - `ActivityFeed.ReadDlp`. Read DLP policy events including detected sensitive data.
66
67 ![API permissions](/images/office365/4-azure-wazuh-app-configure-permissions.png)
68
69 Admin consent is required for API permission changes.
70
71 ![API permissions](/images/office365/4-azure-wazuh-app-configure-permissions-admin-consent.png)
72
73 ### CoPilot configuration
74
75 Next, we will see how to deploy this module in CoPilot. To do so, we will need to navigate to the `Customers` section and select the customer we want to deploy the module to. Once there, we will click on the `Integrations` tab and then on the `Add integration` button. We will select the `Office365` module and fill in the required fields.
76
77 ![Copilot Configuration](/images/office365/copilot_config_customer_details.PNG)
78
79 ![Copilot Configuration](/images/office365/copilot_config_customer_integration.PNG)
80
81 ![Copilot Configuration](/images/office365/copilot_config_customer_integration_config.PNG)
82
83 ![Copilot Configuration](/images/office365/copilot_config_customer_integration_auth.PNG)
84
85 Once deployed, Copilot will automatically add the required configuration to the `Wazuh manager`, deploy the required Index, Stream, and Pipeline to `Graylog` and create the required Dashboards within `Grafana`. `Praeco` will also be configured to send `Exchange` and `Threat Intel` Office365 alerts to `DFIR-IRIS`.
86
87 ### Generate activity on Office 365
88
89 For this example, we will start by generating some activity in our Office 365 Organization. In this case, let's modify a `Communication site` in `SharePoint`. If we do that, we can see that Office 365 will generate a new json event, something like this:
90
91 ```json
92 {
93 "CreationTime": "2021-06-09T22:10:45",
94 "Id": "xxxx-xxxx-xxxx-xxxx-xxxx",
95 "Operation": "FileModified",
96 "OrganizationId": "xxxx-xxxx-xxxx-xxxx-xxxx",
97 "RecordType": "6",
98 "UserKey": "i:xx.f|membership|xxxx@live.com",
99 "UserType": "0",
100 "Version": "1",
101 "Workload": "SharePoint",
102 "ClientIP": "xxx.xx.x.xxx",
103 "ObjectId": "https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
104 "UserId": "xxx.xxx@xxx.com",
105 "CorrelationId": "0b50d09f-e0f2-2000-d9c7-a5b468efc712",
106 "DoNotDistributeEvent": "true",
107 "EventSource": "SharePoint",
108 "ItemType": "File",
109 "ListId": "xxxx-xxxx-xxxx-xxxx-xxxx",
110 "ListItemUniqueId": "xxxx-xxxx-xxxx-xxxx-xxxx",
111 "Site": "xxxx-xxxx-xxxx-xxxx-xxxx",
112 "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
113 "WebId": "xxxx-xxxx-xxxx-xxxx-xxxx",
114 "SourceFileExtension": "aspx",
115 "SiteUrl": "https://xxxx.sharepoint.com/",
116 "SourceFileName": "xxxx.aspx",
117 "SourceRelativeUrl": "SitePages"
118 }
119 ```
120
121 ### Wazuh Rules
122
123 Wazuh provides a series of rules to catch different events on Office365, for this example we will take the rule id `91537` which detects a `Office 365: SharePoint file operation events.` action.
124
125 ```html
126 <rule id="91537" level="3">
127 <if_sid>91532</if_sid>
128 <field name="office365.RecordType" type="osregex">^6$</field>
129 <description>Office 365: SharePoint file operation events.</description>
130 <options>no_full_log</options>
131 <group>SharePointFileOperation</group>
132 </rule>
133 ```
134
135 If Wazuh successfully connects to Office 365 API, the events raised above will trigger these rules and cause an alert like this:
136
137 ```json
138 {
139 "timestamp": "2021-06-09T22:12:54.301+0000",
140 "rule": {
141 "level": 3,
142 "description": "Office 365: SharePoint file operation events.",
143 "id": "91537",
144 "firedtimes": 2,
145 "mail": false,
146 "groups": ["office365", "SharePointFileOperation"]
147 },
148 "agent": {
149 "id": "001",
150 "name": "ubuntu-bionic"
151 },
152 "manager": {
153 "name": "ubuntu-bionic"
154 },
155 "id": "1623276774.47272",
156 "decoder": {
157 "name": "json"
158 },
159 "data": {
160 "integration": "office365",
161 "office365": {
162 "CreationTime": "2021-06-09T22:10:45",
163 "Id": "xxxx-xxxx-xxxx-xxxx-xxxx",
164 "Operation": "FileModified",
165 "OrganizationId": "xxxx-xxxx-xxxx-xxxx-xxxx",
166 "RecordType": "6",
167 "UserKey": "i:xx.f|membership|xxxx@live.com",
168 "UserType": "0",
169 "Version": "1",
170 "Workload": "SharePoint",
171 "ClientIP": "xxx.xx.x.xxx",
172 "ObjectId": "https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
173 "UserId": "xxx.xxx@xxx.com",
174 "CorrelationId": "0b50d09f-e0f2-2000-d9c7-a5b468efc712",
175 "DoNotDistributeEvent": "true",
176 "EventSource": "SharePoint",
177 "ItemType": "File",
178 "ListId": "xxxx-xxxx-xxxx-xxxx-xxxx",
179 "ListItemUniqueId": "xxxx-xxxx-xxxx-xxxx-xxxx",
180 "Site": "xxxx-xxxx-xxxx-xxxx-xxxx",
181 "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
182 "WebId": "xxxx-xxxx-xxxx-xxxx-xxxx",
183 "SourceFileExtension": "aspx",
184 "SiteUrl": "https://xxxx.sharepoint.com/",
185 "SourceFileName": "xxxx.aspx",
186 "SourceRelativeUrl": "SitePages",
187 "Subscription": "Audit.SharePoint"
188 }
189 },
190 "location": "office365"
191 }
192 ```
193
194 For further information, please refer to the [Modules](https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/settings.html#modules)