o365beat.dev.yml

################### O365beat Development Configuration  #######################

# A config file that doesn't get nuked by "make update". "real" stuff goes in
# _meta/beat.yml

# > ./o365beat --path.config . -c o365beat.dev.yml -e --strict.perms=false

o365beat:
  period: 30s

  # used to test custom API endpoints functionality (GCC high)
  # login_url: https://login.microsoftonline.com  # default is https://login.microsoftonline.com
  # resource_url: https://manage.office.com       # default is https://manage.office.com

  # > set -a; . ./o365beat.env; set +a;
  tenant_domain: ${O365BEAT_TENANT_DOMAIN}
  client_secret: ${O365BEAT_CLIENT_SECRET}
  client_id:     ${O365BEAT_CLIENT_ID}     # aka application id (GUID)
  directory_id:  ${O365BEAT_DIRECTORY_ID}  # aka tenant id (GUID)
  registry_file_path: ./tmp/o365beat.state

  content_types:
    - Audit.AzureActiveDirectory
    - Audit.Exchange
    - Audit.SharePoint
    - Audit.General
    # - DLP.All

# map Office 365 Activities API event fields to ECS fields
# API "Common" fields: Id, RecordType, CreationTime, Operation, OrganizationId,
#                      UserType, UserKey, Workload, ResultStatus, ObjectId,
#                      UserId, ClientIP, Scope
# TODO: Docs say event.created = time created in pipeline (not CreationTime)
processors:
  - script:
      when:
        or:
          - has_fields: ['Parameters']
          - has_fields: ['ExtendedProperties']
      lang: javascript
      id: name_value_array_parser
      source: >
        function process(event){
          var processed = event.Get('processed') || {};
          var parameters = event.Get('Parameters')
          if(!!parameters && !!parameters.length){
            processed.Parameters = processed.Parameters || {};
            for(var i = 0; i < parameters.length; i++){
              var p = parameters[i];
              if(p.Name) processed.Parameters[p.Name] = p.Value;
            }
          }
          var extendedProperties = event.Get('ExtendedProperties')
          if(!!extendedProperties && !!extendedProperties.length){
            processed.ExtendedProperties = processed.ExtendedProperties || {};
            for(var i = 0; i < extendedProperties.length; i++){
              var p = extendedProperties[i];
              if(p.Name) processed.ExtendedProperties[p.Name] = p.Value;
            }
          }
          event.Put('processed', processed);
        }
  - dissect:
      field: ClientIP
      tokenizer: '[%{clientip}]:%{clientport}'
      when:
        contains:
          ClientIP: '['
  - dissect:
      field: ClientIP
      tokenizer: '%{clientip}:%{clientport}'
      when:
        contains:
          ClientIP: ':'
        not:
          contains:
            ClientIP: '['
  - convert:
      fields:
        - {from: Id, to: 'event.id', type: string}                # ecs core
        - {from: RecordType, to: 'event.code', type: string}      # ecs extended
        - {from: Operation, to: 'event.action', type: string}     # ecs core
        - {from: OrganizationId, to: 'cloud.account.id', type: string} # ecs extended
        - {from: Workload, to: 'event.category', type: string}    # ecs core
        - {from: ResultStatus, to: 'event.outcome', type: string} # ecs extended
        - {from: UserId, to: 'user.id', type: string}             # ecs core
        - {from: ClientIP, to: 'client.ip', type: ip}             # ecs core
        - {from: 'dissect.clientip', to: 'client.ip', type: ip}   # ecs core
        # the following fields use the challenging array-of-name-value-pairs format
        # converting them to strings fixes issues in elastic, eases non-script parsing
        # easier to rehydrate into arrays from strings than vice versa:
        - {from: Parameters, type: string}                        # no ecs mapping
        - {from: ExtendedProperties, type: string}                # no ecs mapping
        - {from: ModifiedProperties, type: string}                # no ecs mapping
      ignore_missing: true
      fail_on_error: false
      mode: copy # default

# output.console:
#   pretty: true

output.file:
  path: "./tmp/"
  filename: o365beat.json

# output.elasticsearch:
#   hosts: ["http://localhost:9200"]
#   username: "elastic"
#   password: "changeme"

# output.logstash:
#   hosts:
#     - ${O365BEAT_LOGSTASH_HOST}
#   ssl:
#     certificate_authorities:
#       - ${O365BEAT_CLIENT_CA_KEY_PATH}
#     certificate: ${O365BEAT_CLIENT_CER_PATH}
#     key: ${O365BEAT_CLIENT_KEY_PATH}

# https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html
# https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication
# split the p12 into the sub-chunks needed for the conf (private key, public cert, ca cert)
# > openssl pkcs12 -in client.p12 -nocerts -nodes > client.key # Private Key
# > openssl pkcs12 -in client.p12 -clcerts -nokeys  > client.cer # Public Certificate
# > openssl pkcs12 -in client.p12 -cacerts -nokeys -chain > client-ca.cer # CA Certificate