search

ocsf / ocsf-schema

OCSF Schema
Apache License 2.0
581 stars 118 forks source link

Mapping for mailbox rule events #1112

Open eliraz-levi opened 3 weeks ago

eliraz-levi commented 3 weeks ago

Email services provide the capability to configure email forwarding, inbox rules, and more. Such configuration may include complex settings. For example: If an incoming email includes a subject with word “invoice” and the sender is ‘*.amazon.com’ then move the email to the mailbox folder “amazon invoices”. Example of such a rule on M365 platform: 1 2

We may use the Entity Management class, while the entity is the relevant mailbox. However, we need an attribute or object to identify the email service provider as well as the rule that was created or modified. One idea that we discussed in the mapping weekly meeting is creating a new Profile that represents mailbox settings.

cc: @zschmerber-atlassian @cmcginley-splunk

eliraz-levi commented 2 weeks ago

@mikeradka - we would be happy to have your input here

cmcginley-splunk commented 2 weeks ago

@eliraz-levi Sorry, meant to chime in here last Friday.

We don't have a GitLab issue tracking this (tracking it internally), but @mikeradka and I are indeed running into the same issue when trying to map Set-Mailbox.

The options we discussed included:

  1. creating an Email profile (as you suggest)
  2. adding a mailbox object to the Entity Management class

We were planning on making one of these changes in our external extension, and then possibly trying to promote it here to the core schema. I'm not sure which direction Mike was more inclined to though.