feat(defender): Add new check defender_antispam_policy_inbound_no_allowed_domains (#7500)

Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>

tests/providers/m365/services/defender/defender_antispam_policy_inbound_no_allowed_domains/defender_antispam_policy_inbound_no_allowed_domains_test.py

@@ -0,0 +1,126 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_defender_antispam_policy_inbound_no_allowed_domains:
+    def test_policy_without_allowed_domains(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains import (
+                defender_antispam_policy_inbound_no_allowed_domains,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderInboundSpamPolicy,
+            )
+
+            defender_client.inbound_spam_policies = [
+                DefenderInboundSpamPolicy(
+                    identity="Policy1",
+                    allowed_sender_domains=[],
+                )
+            ]
+
+            check = defender_antispam_policy_inbound_no_allowed_domains()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Inbound anti-spam policy Policy1 does not contain allowed domains."
+            )
+            assert result[0].resource == defender_client.inbound_spam_policies[0].dict()
+            assert result[0].resource_name == "Defender Inbound Spam Policy"
+            assert result[0].resource_id == "Policy1"
+            assert result[0].location == "global"
+
+    def test_policy_with_allowed_domains(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains import (
+                defender_antispam_policy_inbound_no_allowed_domains,
+            )
+            from prowler.providers.m365.services.defender.defender_service import (
+                DefenderInboundSpamPolicy,
+            )
+
+            defender_client.inbound_spam_policies = [
+                DefenderInboundSpamPolicy(
+                    identity="Policy2",
+                    allowed_sender_domains=["bad-domain.com"],
+                )
+            ]
+
+            check = defender_antispam_policy_inbound_no_allowed_domains()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Inbound anti-spam policy Policy2 contains allowed domains: ['bad-domain.com']."
+            )
+            assert result[0].resource == defender_client.inbound_spam_policies[0].dict()
+            assert result[0].resource_name == "Defender Inbound Spam Policy"
+            assert result[0].resource_id == "Policy2"
+            assert result[0].location == "global"
+
+    def test_no_inbound_spam_policies(self):
+        defender_client = mock.MagicMock()
+        defender_client.audited_tenant = "audited_tenant"
+        defender_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.m365.services.defender.defender_antispam_policy_inbound_no_allowed_domains.defender_antispam_policy_inbound_no_allowed_domains import (
+                defender_antispam_policy_inbound_no_allowed_domains,
+            )
+
+            defender_client.inbound_spam_policies = []
+
+            check = defender_antispam_policy_inbound_no_allowed_domains()
+            result = check.execute()
+
+            assert len(result) == 0

tests/providers/m365/services/defender/m365_defender_service_test.py

@@ -7,6 +7,7 @@ from prowler.providers.m365.services.defender.defender_service import (
     AntiphishingRule,
     ConnectionFilterPolicy,
     Defender,
+    DefenderInboundSpamPolicy,
     DkimConfig,
     MalwarePolicy,
     OutboundSpamPolicy,
@@ -70,6 +71,19 @@ def mock_defender_get_antiphising_rules(_):
     }
 
 
+def mock_defender_get_inbound_spam_policy(_):
+    return [
+        DefenderInboundSpamPolicy(
+            identity="Policy1",
+            allowed_sender_domains=[],
+        ),
+        DefenderInboundSpamPolicy(
+            identity="Policy2",
+            allowed_sender_domains=["example.com"],
+        ),
+    ]
+
+
 def mock_defender_get_connection_filter_policy(_):
     return ConnectionFilterPolicy(
         ip_allow_list=[],
@@ -323,3 +337,23 @@ class Test_Defender_Service:
             outbound_spam_rules = defender_client.outbound_spam_rules
             assert outbound_spam_rules["Policy1"].state == "Enabled"
             assert outbound_spam_rules["Policy2"].state == "Disabled"
+
+    @patch(
+        "prowler.providers.m365.services.defender.defender_service.Defender._get_inbound_spam_filter_policy",
+        new=mock_defender_get_inbound_spam_policy,
+    )
+    def test__get_inbound_spam_filter_policy(self):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+        ):
+            defender_client = Defender(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            inbound_spam_policies = defender_client.inbound_spam_policies
+            assert inbound_spam_policies[0].allowed_sender_domains == []
+            assert inbound_spam_policies[1].allowed_sender_domains == ["example.com"]
+            defender_client.powershell.close()