feat(defender): add service and new check defender_malware_policy_common_attachments_filter_enabled (#7425)

Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

tests/providers/m365/services/defender/defender_malware_policy_common_attachments_filter_enabled/defender_malware_policy_common_attachments_filter_enabled_test.py

@@ -0,0 +1,141 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_defender_malware_policy_common_attachments_filter_enabled:
+    def test_enable_file_filter_disabled(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled import (
+                defender_malware_policy_common_attachments_filter_enabled,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderMalwarePolicy,
+            )
+
+            defender_client.malware_policies = [
+                DefenderMalwarePolicy(enable_file_filter=False, identity="Policy1"),
+                DefenderMalwarePolicy(enable_file_filter=False, identity="Policy2"),
+            ]
+
+            check = defender_malware_policy_common_attachments_filter_enabled()
+            result = check.execute()
+            assert len(result) == 2
+
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Common Attachment Types Filter is not enabled in the Defender anti-malware policy Policy1."
+            )
+            assert result[0].resource == defender_client.malware_policies[0].dict()
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"
+
+            assert result[1].status == "FAIL"
+            assert (
+                result[1].status_extended
+                == "Common Attachment Types Filter is not enabled in the Defender anti-malware policy Policy2."
+            )
+            assert result[1].resource == defender_client.malware_policies[1].dict()
+            assert result[1].resource_name == "Defender Malware Policy"
+            assert result[1].resource_id == "defenderMalwarePolicy"
+            assert result[1].location == "global"
+
+    def test_enable_file_filter_enabled(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled import (
+                defender_malware_policy_common_attachments_filter_enabled,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderMalwarePolicy,
+            )
+
+            defender_client.malware_policies = [
+                DefenderMalwarePolicy(enable_file_filter=True, identity="Policy1"),
+                DefenderMalwarePolicy(enable_file_filter=True, identity="Policy2"),
+            ]
+
+            check = defender_malware_policy_common_attachments_filter_enabled()
+            result = check.execute()
+            assert len(result) == 2
+
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Common Attachment Types Filter is enabled in the Defender anti-malware policy Policy1."
+            )
+            assert result[0].resource == defender_client.malware_policies[0].dict()
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"
+
+            assert result[1].status == "PASS"
+            assert (
+                result[1].status_extended
+                == "Common Attachment Types Filter is enabled in the Defender anti-malware policy Policy2."
+            )
+            assert result[1].resource == defender_client.malware_policies[1].dict()
+            assert result[1].resource_name == "Defender Malware Policy"
+            assert result[1].resource_id == "defenderMalwarePolicy"
+            assert result[1].location == "global"
+
+    def test_no_policy(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_common_attachments_filter_enabled.defender_malware_policy_common_attachments_filter_enabled import (
+                defender_malware_policy_common_attachments_filter_enabled,
+            )
+
+            defender_client.malware_policies = []
+
+            check = defender_malware_policy_common_attachments_filter_enabled()
+            result = check.execute()
+            assert len(result) == 0

tests/providers/m365/services/defender/m365_defender_service_test.py

@@ -0,0 +1,54 @@
+from unittest import mock
+from unittest.mock import patch
+
+from prowler.providers.m365.models import M365IdentityInfo
+from prowler.providers.m365.services.defender.defender_service import (
+    Defender,
+    DefenderMalwarePolicy,
+)
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+def mock_defender_get_malware_filter_policy(_):
+    return [
+        DefenderMalwarePolicy(enable_file_filter=False, identity="Policy1"),
+        DefenderMalwarePolicy(enable_file_filter=True, identity="Policy2"),
+    ]
+
+
+class Test_Defender_Service:
+    def test_get_client(self):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+        ):
+            defender_client = Defender(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            assert defender_client.client.__class__.__name__ == "GraphServiceClient"
+            assert defender_client.powershell.__class__.__name__ == "M365PowerShell"
+            defender_client.powershell.close()
+
+    @patch(
+        "prowler.providers.m365.services.defender.defender_service.Defender._get_malware_filter_policy",
+        new=mock_defender_get_malware_filter_policy,
+    )
+    def test__get_malware_filter_policy(self):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+        ):
+            defender_client = Defender(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            malware_policies = defender_client.malware_policies
+            assert malware_policies[0].enable_file_filter is False
+            assert malware_policies[0].identity == "Policy1"
+            assert malware_policies[1].enable_file_filter is True
+            assert malware_policies[1].identity == "Policy2"