Parsers & tagging for M365 Defender portal events

[dafneb]

One line description of pull request

Parser for events and activities exported from Microsoft 365 Defender portal.

Description:

• Created parser for events from Activity log.
• Created parser for events exported from Advanced Hunting (DeviceEvents, DeviceProcessEvents, DeviceNetworkEvents, DeviceImageLoadEvents, DeviceFileEvents, DeviceLogonEvents, DeviceRegistryEvents, UrlClickEvents).
• Created tags for defender events.

Related issue (if applicable):

Notes:

All contributions to Plaso undergo code review. This makes sure that the code has appropriate test coverage and conforms to the Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in order, and then a maintainer will review your code.

Checklist:

• [ ] Automated checks (GitHub Actions, AppVeyor) pass
• [ ] No new new dependencies are required or l2tdevtools has been updated
• [x] Reviewer assigned

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 87.06294% with 37 lines in your changes missing coverage. Please review.

Project coverage is 85.25%. Comparing base (ed8a139) to head (59fb297). Report is 37 commits behind head on main.

Files	Patch %	Lines
plaso/parsers/defender_hunting.py	88.31%	27 Missing :warning:
plaso/parsers/m365_activitylog.py	81.81%	10 Missing :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #4794 +/- ## ========================================== + Coverage 85.24% 85.25% +0.01% ========================================== Files 426 428 +2 Lines 38532 38818 +286 ========================================== + Hits 32847 33096 +249 - Misses 5685 5722 +37 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[joachimmetz]

@dafneb I'll make some changes to make sure the code meets the style guide. I'll leave comments without tagging you in, consider them informational/educational.

[joachimmetz]

Some references:

• https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicefileevents-table
• https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-schema-tables

[joachimmetz]

Looks like M365 AH defines many more tables https://github.com/MicrosoftDocs/microsoft-365-docs/tree/public/microsoft-365/security/defender

[joachimmetz]

Might be useful to keep notes about the format and queries somewhere. Started https://github.com/forensicswiki/wiki/pull/223/files