From e9aca866c88e702986ecc6af246ae2e3fe716000 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Thu, 11 Sep 2025 14:00:52 +0200 Subject: [PATCH] fix(defender): change policies rules key (#8703) Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com> Co-authored-by: HugoPBrito --- prowler/CHANGELOG.md | 1 + .../services/defender/defender_service.py | 34 +++++++++++-------- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 1ccff9e5dd..02863899fb 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Replaced old check id with new ones for compliance files [(#8682)](https://github.com/prowler-cloud/prowler/pull/8682) +- Replace defender rules policies key to use old name [(#8702)](https://github.com/prowler-cloud/prowler/pull/8702) ## [v5.12.0] (Prowler v5.12.0) diff --git a/prowler/providers/m365/services/defender/defender_service.py b/prowler/providers/m365/services/defender/defender_service.py index 5d198b5888..d3ede5734a 100644 --- a/prowler/providers/m365/services/defender/defender_service.py +++ b/prowler/providers/m365/services/defender/defender_service.py @@ -91,7 +91,7 @@ class Defender(M365Service): malware_rule = [malware_rule] for rule in malware_rule: if rule: - malware_rules[rule.get("Name", "")] = MalwareRule( + malware_rules[rule.get("MalwareFilterPolicy", "")] = MalwareRule( state=rule.get("State", ""), priority=rule.get("Priority", 0), users=rule.get("SentTo", None), @@ -152,12 +152,14 @@ class Defender(M365Service): antiphishing_rule = [antiphishing_rule] for rule in antiphishing_rule: if rule: - antiphishing_rules[rule.get("Name", "")] = AntiphishingRule( - state=rule.get("State", ""), - priority=rule.get("Priority", 0), - users=rule.get("SentTo", None), - groups=rule.get("SentToMemberOf", None), - domains=rule.get("RecipientDomainIs", None), + antiphishing_rules[rule.get("AntiPhishPolicy", "")] = ( + AntiphishingRule( + state=rule.get("State", ""), + priority=rule.get("Priority", 0), + users=rule.get("SentTo", None), + groups=rule.get("SentToMemberOf", None), + domains=rule.get("RecipientDomainIs", None), + ) ) except Exception as error: logger.error( @@ -250,7 +252,9 @@ class Defender(M365Service): outbound_spam_rule = [outbound_spam_rule] for rule in outbound_spam_rule: if rule: - outbound_spam_rules[rule.get("Name", "")] = OutboundSpamRule( + outbound_spam_rules[ + rule.get("HostedOutboundSpamFilterPolicy", "") + ] = OutboundSpamRule( state=rule.get("State", "Disabled"), priority=rule.get("Priority", 0), users=rule.get("From", None), @@ -330,12 +334,14 @@ class Defender(M365Service): inbound_spam_rule = [inbound_spam_rule] for rule in inbound_spam_rule: if rule: - inbound_spam_rules[rule.get("Name", "")] = InboundSpamRule( - state=rule.get("State", "Disabled"), - priority=rule.get("Priority", 0), - users=rule.get("SentTo", None), - groups=rule.get("SentToMemberOf", None), - domains=rule.get("RecipientDomainIs", None), + inbound_spam_rules[rule.get("HostedContentFilterPolicy", "")] = ( + InboundSpamRule( + state=rule.get("State", "Disabled"), + priority=rule.get("Priority", 0), + users=rule.get("SentTo", None), + groups=rule.get("SentToMemberOf", None), + domains=rule.get("RecipientDomainIs", None), + ) ) except Exception as error: logger.error(