[o365] Add extra values to related.user (#8803)

chrisberkhout · efd6 · web-flow · commit 8d10ffc48aec · 2024-01-18T12:17:46.000+01:00
The `o365.audit.Parameters.User` value will be added to `related.user`,
when it is populated.

The `o365.audit.Data.*` fields `f3u`, `suid`, `tsd` and `trc` seem to
have values that match the format of an email address, and will be added
to `related.user` in those cases.

---------

Co-authored-by: Dan Kortschak &lt;90160302+efd6@users.noreply.github.com&gt;
diff --git a/packages/o365/changelog.yml b/packages/o365/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: 2.1.0
+  changes:
+    - description: Add extra values to `related.user`.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/8803
 - version: 2.0.0
   changes:
     - description: Mapping, parsing of o365.audit fields Platform and Data.*.
diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json
@@ -5837,6 +5837,9 @@
             "related": {
                 "ip": [
                     "67.43.156.13"
+                ],
+                "user": [
+                    "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management"
                 ]
             },
             "server": {
@@ -6682,6 +6685,9 @@
             "related": {
                 "ip": [
                     "67.43.156.13"
+                ],
+                "user": [
+                    "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management"
                 ]
             },
             "server": {
diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json
@@ -70,6 +70,11 @@
                 "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd",
                 "name": "mytenant.onmicrosoft.com"
             },
+            "related": {
+                "user": [
+                    "asr@testsiem.onmicrosoft.com"
+                ]
+            },
             "rule": {
                 "category": "AccessGovernance",
                 "description": "asr@testsiem.onmicrosoft.com",
@@ -166,6 +171,11 @@
                 "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd",
                 "name": "mytenant.onmicrosoft.com"
             },
+            "related": {
+                "user": [
+                    "asr@testsiem.onmicrosoft.com"
+                ]
+            },
             "rule": {
                 "category": "AccessGovernance",
                 "id": "17d51759-88e1-40c1-8df3-20bcf2e43057",
diff --git a/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
@@ -1044,6 +1044,11 @@ processors:
       value: "{{file.owner}}"
       allow_duplicates: false
       if: ctx.file?.owner != null
+  - append:
+      field: related.user
+      value: "{{o365audit.Parameters.User}}"
+      allow_duplicates: false
+      if: ctx.o365audit?.Parameters?.User != null
   - rename:
       field: o365audit.ExtendedProperties.UserAgent
       target_field: user_agent.original
@@ -1166,6 +1171,26 @@ processors:
       formats:
         - ISO8601
       if: ctx.o365audit?.Data?.ttdt != null
+  - append:
+      field: related.user
+      value: "{{o365audit.Data.f3u}}"
+      allow_duplicates: false
+      if: ctx.o365audit?.Data?.f3u?.splitOnToken('@')?.length == 2 && ctx.o365audit.Data.f3u.length() >= 3;
+  - append:
+      field: related.user
+      value: "{{o365audit.Data.suid}}"
+      allow_duplicates: false
+      if: ctx.o365audit?.Data?.suid?.splitOnToken('@')?.length == 2 && ctx.o365audit.Data.suid.length() >= 3;
+  - append:
+      field: related.user
+      value: "{{o365audit.Data.tsd}}"
+      allow_duplicates: false
+      if: ctx.o365audit?.Data?.tsd?.splitOnToken('@')?.length == 2 && ctx.o365audit.Data.tsd.length() >= 3;
+  - append:
+      field: related.user
+      value: "{{o365audit.Data.trc}}"
+      allow_duplicates: false
+      if: ctx.o365audit?.Data?.trc?.splitOnToken('@')?.length == 2 && ctx.o365audit.Data.trc.length() >= 3;
   - rename:
       field: o365audit
       target_field: o365.audit
diff --git a/packages/o365/manifest.yml b/packages/o365/manifest.yml
@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft 365
-version: "2.0.0"
+version: "2.1.0"
 description: Collect logs from Microsoft 365 with Elastic Agent.
 type: integration
 format_version: "3.0.0"
