Exploratory: Investigate automating MS.SECURITYSUITE.4.2v1

[adhilto]

Prerequisites

• This issue has an informative and human-readable title.
• Assignee should meet with issue author before starting work.

💡 Summary

Determine if it is possible to automate MS.SECURITYSUITE.4.2v1, "The alerts SHOULD be sent to a monitored address or incorporated into a Security Information and Event Management (SIEM)."

Motivation and context

Currently this is a manual check, but it may be possible to automate.

Implementation notes

So I see two parts to this:

1. Can we check to see if email notifications are configured?
2. Can we check if SIEM integration is configured?

For the email portion, I haven’t checked, but I’d be surprised if this isn’t data we could get from one of the APIs. We could then have ScubaGear either assert that at least one email has been added or add a config file option for the user to specify email addresses we should look for. So automatable? Need to double check, but it seems likely.

The SIEM part is a little harder. After a cursory look, I think the SIEM integration process looks like so:

1. Register an application in Entra ID and assign it the “appropriate permissions” (not sure which specifically).
2. Subscribe the application to the relevant content types. I’m not sure what the various content types are, but for now let’s assume there are some specific content types that correspond to these alerts.
3. After that, you configure your SIEM (e.g., Splunk) to poll regularly to check for new content.

So I think ScubaGear checking for SIEM integration would look like looking for an app registration with the right permissions and subscriptions. There actually is a list subscriptions API endpoint. So this part may be automatable too, though more research is needed.

To sum up, here are the specific questions we’d need to answer:

1. Is there an API that tells us if email notifications for these alerts is configured?
2. What are the permissions the app would need to be registered with?
3. Which subscription types would the app need?
4. Can we call the list subscriptions API endpoint or is it something that can only be accessed from the app registered?

Some resources:

• https://learn.microsoft.com/en-us/defender-office-365/siem-integration-with-office-365-ti
• https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

Acceptance criteria

• We determine if it's possible to automate this policy and the level of effort
• Document findings (comment on this issue is fine)
• If automatable, open follow up issue to implement it