Add Office365 Syslog Type rule to pipeline rules (#386)
taylor_socfortress committed
Dec 20, 2024 at 09:53 UTC
203a1e809086fc3a5a02fa5e43dec77b78259044
1 file changed
+22
backend/app/integrations/office365/services/provision.py
+22
@@ -576,6 +576,7 @@ async def create_pipeline_rules(non_existing_rules: List[str]) -> None:
576
"""
577
rule_creators = {
578
"Office365 Timestamp - UTC": create_office365_utc_rule,
579
+ "Office365 Syslog Type": create_office365_syslog_type_rule,
580
"WAZUH CREATE FIELD SYSLOG LEVEL - INFO": create_wazuh_info_rule,
581
"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING": create_wazuh_warning_rule,
582
"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE": create_wazuh_notice_rule,
@@ -609,6 +610,27 @@ async def create_office365_utc_rule(rule_title: str) -> None:
610
)
611
612
613
+async def create_office365_syslog_type_rule(rule_title: str) -> None:
614
+ """
615
+ Creates the 'Office365 Syslog Type' pipeline rule.
616
+ """
617
+ rule_source = (
618
+ f'rule "{rule_title}"\n'
619
+ "when\n"
620
+ ' $message.rule_group1 == "office365"\n'
621
+ "then\n"
622
+ ' set_field("syslog_type", "office365");\n'
623
+ "end"
624
+ )
625
+ await create_pipeline_rule(
626
+ CreatePipelineRule(
627
+ title=rule_title,
628
+ description=rule_title,
629
+ source=rule_source,
630
+ ),
631
+ )
632
+
633
+
634
async def create_wazuh_info_rule(rule_title: str) -> None:
635
"""
636
Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - INFO' pipeline rule.