Office 365 integration is missing awareness of additional Office 365 Audit API audit log record types

[colin-stubbs]

Current map from o365audit.RecordType only maps up to 66 -> "MicrosoftForms"

Microsoft now defines audit log record types up to 148 as per: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32

A secondary issue is that the ingest pipeline for the integration only supports ECS mapping for a sub-set of record types, e.g.

1. ExchangeAdmin ( 1 )
2. ExchangeItem ( 2 )
3. AzureActiveDirectory ( 8 )
4. AzureActiveDirectoryStsLogon ( 15 )
5. SharePointFileOperation ( 56 )
6. SecurityComplianceAlerts ( 42 )
7. ComplianceDLPSharePoint ( 11 )
8. ComplianceDLPExchange ( 13 )
9. Yammer ( 22 )
10. MicrosoftTeams ( 25 )

There will be great value in also ensuring the following record types are mapped appropriately, particularly to trigger alerts in Elastic Security via the normal External Alerts rule when event.kind: alert is set.

This is primarily to support "Microsoft Defender for Office 365" , which IS NOT the same as Microsoft 365 Defender. Refer to: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/overview?view=o365-worldwide

Value	Member name	Description	Do we have a sample yet?
28	ThreatIntelligence	Phishing and malware events from Exchange Online Protection and Microsoft Defender for Office 365.	YES
29	MailSubmission	Submission events from Exchange Online Protection and Microsoft Defender for Office 365.	YES
34	ThreatFinder	Campaign-related events from Microsoft Defender for Office 365.	NO
41	ThreatIntelligenceUrl	Safe links time-of-block and block override events from Microsoft Defender for Office 365.	YES
47	ThreatIntelligenceAtpContent	Phishing and malware events for files in SharePoint, OneDrive for Business, and Microsoft Teams from Microsoft Defender for Office 365.	YES
61	InformationWorkerProtection	Events related to compromised user alerts.	NO
62	Campaign	Email campaign events from Microsoft Defender for Office 365.	NO
90	MSTIC	Threat intelligence events in Microsoft Defender for Office 365.	NO

The above, in some cases, MAY overlap with the Microsoft 365 Defender/ATP integration, however from what I've seen from live logs ingested via Microsoft 365 Defender/ATP integrations, they do not.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

Closing, as the record types listed above are now supported.