feat(defender): add new check for spf records published

tests/providers/m365/services/defender/defender_domain_spf_records_published/defender_domain_spf_records_published_test.py

@@ -0,0 +1,132 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_defender_domain_spf_records_published:
+    def test_no_domains(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+        defender_client.domain_service_configurations = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published import (
+                defender_domain_spf_records_published,
+            )
+
+            check = defender_domain_spf_records_published()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_domain_spf_record_present(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published import (
+                defender_domain_spf_records_published,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DomainServiceConfiguration,
+            )
+
+            domain_id = "domain1"
+
+            record = mock.MagicMock()
+            record.record_type = "Txt"
+            record.text = "v=spf1 include:spf.protection.outlook.com -all"
+
+            defender_client.domain_service_configurations = {
+                domain_id: DomainServiceConfiguration(
+                    service_configuration_records=[record]
+                )
+            }
+
+            check = defender_domain_spf_records_published()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"SPF record is published on Exchange Online for domain with ID {domain_id}."
+            )
+            assert result[0].resource == {}
+            assert result[0].resource_name == domain_id
+            assert result[0].resource_id == domain_id
+            assert result[0].location == "global"
+
+    def test_domain_spf_record_missing(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_domain_spf_records_published.defender_domain_spf_records_published import (
+                defender_domain_spf_records_published,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DomainServiceConfiguration,
+            )
+
+            domain_id = "domain2"
+
+            record = mock.MagicMock()
+            record.record_type = "Txt"
+            record.text = ""
+
+            defender_client.domain_service_configurations = {
+                domain_id: DomainServiceConfiguration(
+                    service_configuration_records=[record]
+                )
+            }
+
+            check = defender_domain_spf_records_published()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"SPF record is not published on Exchange Online for domain with ID {domain_id}."
+            )
+            assert result[0].resource == {}
+            assert result[0].resource_name == domain_id
+            assert result[0].resource_id == domain_id
+            assert result[0].location == "global"

tests/providers/m365/services/defender/m365_defender_service_test.py

@@ -9,6 +9,7 @@ from prowler.providers.m365.services.defender.defender_service import (
     Defender,
     DefenderInboundSpamPolicy,
     DkimConfig,
+    DomainServiceConfiguration,
     MalwarePolicy,
     MalwareRule,
     OutboundSpamPolicy,
@@ -160,6 +161,26 @@ def mock_defender_get_outbound_spam_filter_rule(_):
     }
 
 
+async def mock_defender_get_domain_service_configuration(_):
+    class Record:
+        def __init__(self, record_type, txt):
+            self.record_type = record_type
+            self.txt = txt
+
+    spf_record = Record("Txt", "v=spf1 include:spf.protection.outlook.com -all")
+    mx_record = Record("Mx", "")
+    empty_txt_record = Record("Txt", "")
+
+    return {
+        "Domain1": DomainServiceConfiguration(
+            service_configuration_records=[spf_record, mx_record]
+        ),
+        "Domain2": DomainServiceConfiguration(
+            service_configuration_records=[empty_txt_record]
+        ),
+    }
+
+
 class Test_Defender_Service:
     def test_get_client(self):
         with (
@@ -442,3 +463,48 @@ class Test_Defender_Service:
             assert report_submission_policy.report_not_junk_addresses == []
             assert report_submission_policy.report_phish_addresses == []
             assert report_submission_policy.report_chat_message_enabled is True
+
+    @patch(
+        "prowler.providers.m365.services.defender.defender_service.Defender._get_domain_service_configurations",
+        new=mock_defender_get_domain_service_configuration,
+    )
+    def test_get_domain_service_configuration(self):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+        ):
+            defender_client = Defender(set_mocked_m365_provider())
+
+            domain_service_config = defender_client.domain_service_configurations
+            assert len(domain_service_config) == 2
+            assert (
+                domain_service_config["Domain1"]
+                .service_configuration_records[0]
+                .record_type
+                == "Txt"
+            )
+            assert (
+                domain_service_config["Domain1"].service_configuration_records[0].txt
+                == "v=spf1 include:spf.protection.outlook.com -all"
+            )
+            assert (
+                domain_service_config["Domain1"]
+                .service_configuration_records[1]
+                .record_type
+                == "Mx"
+            )
+            assert (
+                domain_service_config["Domain1"].service_configuration_records[1].txt
+                == ""
+            )
+            assert (
+                domain_service_config["Domain2"]
+                .service_configuration_records[0]
+                .record_type
+                == "Txt"
+            )
+            assert (
+                domain_service_config["Domain2"].service_configuration_records[0].txt
+                == ""
+            )