[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)

* Adjust Integration Name

* Update defense_evasion_microsoft_365_mailboxauditbypassassociation.toml

* Update integration name

* .

* Case

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 5a16a222ad)

rules/integrations/o365/collection_microsoft_365_new_inbox_rule.toml

@@ -25,7 +25,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Inbox Forwarding Rule Created"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide",
     "https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps",

rules/integrations/o365/credential_access_microsoft_365_brute_force_user_account_attempt.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Attempts to Brute Force a Microsoft 365 User Account"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = ["https://blueteamblog.com/7-ways-to-monitor-your-office-365-logs-using-siem"]
 risk_score = 73
 rule_id = "26f68dba-ce29-497b-8e13-b4fde1db5a2d"

rules/integrations/o365/credential_access_microsoft_365_potential_password_spraying_attack.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Potential Password Spraying of Microsoft 365 User Accounts"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 risk_score = 73
 rule_id = "3efee4f0-182a-40a8-a835-102c68a4175d"
 severity = "high"

rules/integrations/o365/credential_access_user_excessive_sso_logon_errors.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "O365 Excessive Single Sign-On Logon Errors"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 risk_score = 73
 rule_id = "2de10e77-c144-4e69-afb7-344e7127abd0"
 severity = "high"

rules/integrations/o365/defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange DLP Policy Removed"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-dlppolicy?view=exchange-ps",
     "https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide",

rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Malware Filter Policy Deletion"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterpolicy?view=exchange-ps",
 ]

rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Malware Filter Rule Modification"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterrule?view=exchange-ps",
     "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-malwarefilterrule?view=exchange-ps",

rules/integrations/o365/defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Safe Attachment Rule Disabled"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safeattachmentrule?view=exchange-ps",
 ]

rules/integrations/o365/defense_evasion_microsoft_365_mailboxauditbypassassociation.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "O365 Mailbox Audit Logging Bypass"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://twitter.com/misconfig/status/1476144066807140355",
 ]

rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_creation.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Transport Rule Creation"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps",
     "https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules",

rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_mod.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Transport Rule Modification"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-transportrule?view=exchange-ps",
     "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-transportrule?view=exchange-ps",

rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml

@@ -17,7 +17,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Mass download by a single user"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 """
 references = [
     "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",

rules/integrations/o365/impact_microsoft_365_potential_ransomware_activity.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Potential ransomware activity"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 """
 references = [
     "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",

rules/integrations/o365/impact_microsoft_365_unusual_volume_of_file_deletion.toml

@@ -17,7 +17,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Unusual Volume of File Deletion"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 """
 references = [
     "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",

rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Anti-Phish Policy Deletion"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-antiphishpolicy?view=exchange-ps",
     "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide",

rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Anti-Phish Rule Modification"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-antiphishrule?view=exchange-ps",
     "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-antiphishrule?view=exchange-ps",

rules/integrations/o365/initial_access_microsoft_365_exchange_safelinks_disabled.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Safe Link Policy Disabled"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safelinksrule?view=exchange-ps",
     "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-safe-links?view=o365-worldwide",

rules/integrations/o365/initial_access_microsoft_365_impossible_travel_activity.toml

@@ -18,7 +18,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Impossible travel activity"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 """
 references = [
     "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",

rules/integrations/o365/initial_access_microsoft_365_user_restricted_from_sending_email.toml

@@ -17,7 +17,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 User Restricted from Sending Email"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 """
 references = [
     "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",

rules/integrations/o365/initial_access_o365_user_reported_phish_malware.toml

@@ -20,7 +20,7 @@ license = "Elastic License v2"
 name = "O365 Email Reported by User as Malware or Phish"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://support.microsoft.com/en-us/office/use-the-report-message-add-in-b5caa9f1-cdf3-4443-af8c-ff724ea719d2?ui=en-us&rs=en-us&ad=us",
 ]

rules/integrations/o365/lateral_movement_malware_uploaded_onedrive.toml

@@ -20,7 +20,7 @@ license = "Elastic License v2"
 name = "OneDrive Malware File Upload"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide",
 ]

rules/integrations/o365/lateral_movement_malware_uploaded_sharepoint.toml

@@ -20,7 +20,7 @@ license = "Elastic License v2"
 name = "SharePoint Malware File Upload"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide",
 ]

rules/integrations/o365/microsoft_365_exchange_dkim_signing_config_disabled.toml

@@ -25,7 +25,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange DKIM Signing Configuration Disabled"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/set-dkimsigningconfig?view=exchange-ps",
 ]

rules/integrations/o365/microsoft_365_teams_custom_app_interaction_allowed.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Teams Custom Application Interaction Allowed"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = ["https://docs.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload"]
 risk_score = 47
 rule_id = "bbd1a775-8267-41fa-9232-20e5582596ac"

rules/integrations/o365/persistence_exchange_suspicious_mailbox_right_delegation.toml

@@ -18,7 +18,7 @@ license = "Elastic License v2"
 name = "O365 Exchange Suspicious Mailbox Right Delegation"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 risk_score = 21
 rule_id = "0ce6487d-8069-4888-9ddd-61b52490cebc"
 severity = "low"

rules/integrations/o365/persistence_microsoft_365_exchange_management_role_assignment.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Exchange Management Group Role Assignment"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps",
     "https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide",

rules/integrations/o365/persistence_microsoft_365_global_administrator_role_assign.toml

@@ -20,7 +20,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Global Administrator Role Assigned"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator"
 ]

rules/integrations/o365/persistence_microsoft_365_teams_external_access_enabled.toml

@@ -24,7 +24,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Teams External Access Enabled"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = ["https://docs.microsoft.com/en-us/microsoftteams/manage-external-access"]
 risk_score = 47
 rule_id = "27f7c15a-91f8-4c3d-8b9e-1f99cc030a51"

rules/integrations/o365/persistence_microsoft_365_teams_guest_access_enabled.toml

@@ -23,7 +23,7 @@ license = "Elastic License v2"
 name = "Microsoft 365 Teams Guest Access Enabled"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/skype/get-csteamsclientconfiguration?view=skype-ps",
 ]

rules/integrations/o365/privilege_escalation_new_or_modified_federation_domain.toml

@@ -16,7 +16,7 @@ license = "Elastic License v2"
 name = "New or Modified Federation Domain"
 note = """## Config
 
-The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
               "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-accepteddomain?view=exchange-ps",
               "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-federateddomain?view=exchange-ps",

tests/test_all_rules.py

@@ -602,7 +602,7 @@ class TestIntegrationRules(BaseRuleTest):
             'cyberarkpas': render('CyberArk Privileged Access Security (PAS)'),
             'gcp': render('GCP'),
             'google_workspace': render('Google Workspace'),
-            'o365': render('Microsoft 365'),
+            'o365': render('Office 365 Logs'),
             'okta': render('Okta'),
         }