Add syslog type office365 (#490)
* Add SYSLOG TYPE OFFICE365 rule to create_office365_pipeline function * Comment out unused import statements for clarity in provision.py * precommit fixes
taylor_socfortress committed
Aug 13, 2025 at 12:39 UTC
efc91d3311fe447ef96029095812e6c2eab4c8b8
2 files changed
+4
-2
backend/app/customer_provisioning/services/provision.py
+3
-2
@@ -7,7 +7,7 @@ from sqlalchemy import update
7
from sqlalchemy.ext.asyncio import AsyncSession
8
from sqlalchemy.future import select
9
10
-from app.agents.routes.agents import check_wazuh_manager_version
10
+# from app.agents.routes.agents import check_wazuh_manager_version
11
from app.agents.routes.agents import get_wazuh_manager_version
12
from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
13
from app.connectors.grafana.services.dashboards import provision_dashboards
@@ -27,7 +27,8 @@ from app.customer_provisioning.schema.wazuh_worker import ProvisionWorkerRespons
27
from app.customer_provisioning.services.grafana import create_grafana_datasource
28
from app.customer_provisioning.services.grafana import create_grafana_folder
29
from app.customer_provisioning.services.grafana import create_grafana_organization
30
-from app.customer_provisioning.services.grafana import create_vulnerability_datasource
30
+
31
+# from app.customer_provisioning.services.grafana import create_vulnerability_datasource
32
from app.customer_provisioning.services.graylog import connect_stream_to_pipeline
33
from app.customer_provisioning.services.graylog import create_event_stream
34
from app.customer_provisioning.services.graylog import create_index_set
backend/app/integrations/office365/services/provision.py
+1
@@ -761,6 +761,7 @@ async def create_office365_pipeline(pipeline_title: str) -> None:
761
'rule "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"\n'
762
'rule "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"\n'
763
'rule "Office365 Timestamp - UTC"\n'
764
+ 'rule "SYSLOG TYPE OFFICE365"\n'
765
"end"
766
)
767
await create_pipeline_graylog(