feat(defender): add new check defender_malware_policy_notifications_internal_users_malware_enabled (#7435)

Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

tests/providers/m365/services/defender/defender_malware_policy_common_attachments_filter_enabled/defender_malware_policy_common_attachments_filter_enabled_test.py

@@ -30,34 +30,28 @@ class Test_defender_malware_policy_common_attachments_filter_enabled:
             )
 
             defender_client.malware_policies = [
-                DefenderMalwarePolicy(enable_file_filter=False, identity="Policy1"),
-                DefenderMalwarePolicy(enable_file_filter=False, identity="Policy2"),
+                DefenderMalwarePolicy(
+                    enable_file_filter=False,
+                    identity="Policy1",
+                    enable_internal_sender_admin_notifications=False,
+                    internal_sender_admin_address="",
+                ),
             ]
 
             check = defender_malware_policy_common_attachments_filter_enabled()
             result = check.execute()
-            assert len(result) == 2
+            assert len(result) == 1
 
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == "Common Attachment Types Filter is not enabled in the Defender anti-malware policy Policy1."
+                == "Common Attachment Types Filter is not enabled in anti-malware policy Policy1."
             )
             assert result[0].resource == defender_client.malware_policies[0].dict()
             assert result[0].resource_name == "Defender Malware Policy"
             assert result[0].resource_id == "defenderMalwarePolicy"
             assert result[0].location == "global"
 
-            assert result[1].status == "FAIL"
-            assert (
-                result[1].status_extended
-                == "Common Attachment Types Filter is not enabled in the Defender anti-malware policy Policy2."
-            )
-            assert result[1].resource == defender_client.malware_policies[1].dict()
-            assert result[1].resource_name == "Defender Malware Policy"
-            assert result[1].resource_id == "defenderMalwarePolicy"
-            assert result[1].location == "global"
-
     def test_enable_file_filter_enabled(self):
         defender_client = mock.MagicMock()
         defender_client.audited_tenant = "audited_tenant"
@@ -84,34 +78,28 @@ class Test_defender_malware_policy_common_attachments_filter_enabled:
             )
 
             defender_client.malware_policies = [
-                DefenderMalwarePolicy(enable_file_filter=True, identity="Policy1"),
-                DefenderMalwarePolicy(enable_file_filter=True, identity="Policy2"),
+                DefenderMalwarePolicy(
+                    enable_file_filter=True,
+                    identity="Policy1",
+                    enable_internal_sender_admin_notifications=False,
+                    internal_sender_admin_address="",
+                ),
             ]
 
             check = defender_malware_policy_common_attachments_filter_enabled()
             result = check.execute()
-            assert len(result) == 2
+            assert len(result) == 1
 
             assert result[0].status == "PASS"
             assert (
                 result[0].status_extended
-                == "Common Attachment Types Filter is enabled in the Defender anti-malware policy Policy1."
+                == "Common Attachment Types Filter is enabled in anti-malware policy Policy1."
             )
             assert result[0].resource == defender_client.malware_policies[0].dict()
             assert result[0].resource_name == "Defender Malware Policy"
             assert result[0].resource_id == "defenderMalwarePolicy"
             assert result[0].location == "global"
 
-            assert result[1].status == "PASS"
-            assert (
-                result[1].status_extended
-                == "Common Attachment Types Filter is enabled in the Defender anti-malware policy Policy2."
-            )
-            assert result[1].resource == defender_client.malware_policies[1].dict()
-            assert result[1].resource_name == "Defender Malware Policy"
-            assert result[1].resource_id == "defenderMalwarePolicy"
-            assert result[1].location == "global"
-
     def test_no_policy(self):
         defender_client = mock.MagicMock()
         defender_client.audited_tenant = "audited_tenant"
@@ -138,4 +126,13 @@ class Test_defender_malware_policy_common_attachments_filter_enabled:
 
             check = defender_malware_policy_common_attachments_filter_enabled()
             result = check.execute()
-            assert len(result) == 0
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Common Attachment Types Filter is not enabled."
+            )
+            assert result[0].resource == {}
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"

tests/providers/m365/services/defender/defender_malware_policy_notifications_internal_users_malware_enabled/defender_malware_policy_notifications_internal_users_malware_enabled_test.py

@@ -0,0 +1,155 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_defender_malware_policy_notifications_internal_users_malware_enabled:
+    def test_notifications_disabled(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled import (
+                defender_malware_policy_notifications_internal_users_malware_enabled,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderMalwarePolicy,
+            )
+
+            defender_client.malware_policies = [
+                DefenderMalwarePolicy(
+                    enable_file_filter=True,
+                    identity="Default",
+                    enable_internal_sender_admin_notifications=False,
+                    internal_sender_admin_address="",
+                )
+            ]
+
+            check = (
+                defender_malware_policy_notifications_internal_users_malware_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Notifications for internal users sending malware are not enabled."
+            )
+            assert result[0].resource == defender_client.malware_policies[0].dict()
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"
+
+    def test_notifications_enabled_without_email(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled import (
+                defender_malware_policy_notifications_internal_users_malware_enabled,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderMalwarePolicy,
+            )
+
+            defender_client.malware_policies = [
+                DefenderMalwarePolicy(
+                    enable_file_filter=True,
+                    identity="Default",
+                    enable_internal_sender_admin_notifications=True,
+                    internal_sender_admin_address="",
+                )
+            ]
+
+            check = (
+                defender_malware_policy_notifications_internal_users_malware_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Notifications for internal users sending malware are enabled, but no email addresses are configured."
+            )
+            assert result[0].resource == defender_client.malware_policies[0].dict()
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"
+
+    def test_notifications_enabled_with_email(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_malware_policy_notifications_internal_users_malware_enabled.defender_malware_policy_notifications_internal_users_malware_enabled import (
+                defender_malware_policy_notifications_internal_users_malware_enabled,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderMalwarePolicy,
+            )
+
+            defender_client.malware_policies = [
+                DefenderMalwarePolicy(
+                    enable_file_filter=True,
+                    identity="Default",
+                    enable_internal_sender_admin_notifications=True,
+                    internal_sender_admin_address="security@example.com",
+                )
+            ]
+
+            check = (
+                defender_malware_policy_notifications_internal_users_malware_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Notifications for internal users sending malware are enabled."
+            )
+            assert result[0].resource == defender_client.malware_policies[0].dict()
+            assert result[0].resource_name == "Defender Malware Policy"
+            assert result[0].resource_id == "defenderMalwarePolicy"
+            assert result[0].location == "global"

tests/providers/m365/services/defender/m365_defender_service_test.py

@@ -11,8 +11,18 @@ from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
 
 def mock_defender_get_malware_filter_policy(_):
     return [
-        DefenderMalwarePolicy(enable_file_filter=False, identity="Policy1"),
-        DefenderMalwarePolicy(enable_file_filter=True, identity="Policy2"),
+        DefenderMalwarePolicy(
+            enable_file_filter=False,
+            identity="Policy1",
+            enable_internal_sender_admin_notifications=False,
+            internal_sender_admin_address="",
+        ),
+        DefenderMalwarePolicy(
+            enable_file_filter=True,
+            identity="Policy2",
+            enable_internal_sender_admin_notifications=True,
+            internal_sender_admin_address="security@example.com",
+        ),
     ]
 
 
@@ -50,5 +60,16 @@ class Test_Defender_Service:
             malware_policies = defender_client.malware_policies
             assert malware_policies[0].enable_file_filter is False
             assert malware_policies[0].identity == "Policy1"
+            assert (
+                malware_policies[0].enable_internal_sender_admin_notifications is False
+            )
+            assert malware_policies[0].internal_sender_admin_address == ""
             assert malware_policies[1].enable_file_filter is True
             assert malware_policies[1].identity == "Policy2"
+            assert (
+                malware_policies[1].enable_internal_sender_admin_notifications is True
+            )
+            assert (
+                malware_policies[1].internal_sender_admin_address
+                == "security@example.com"
+            )