Office365 integration scan messages enrichment

[cborla]

Related issue	Documentation	Manual Testing
#14091	Documentation	wazuh/wazuh-qa#3049

Description

The goal of this change is encrease the information about how Office365 integration works.
2 new messages are added, one when first scan runs, with the legend Bookmark updated to '2022-06-16T18:21:58Z' for tenant <TenatanID> and subscription <SubscriptionID>, waiting '60' seconds to run first scan, where the first date is the UTC date as the API request to Office365 server, and the '60' seconds are the interval time. Second message is similar than first, it only change the word next instead the word first, and it shows when bookmark is updated. '2022-06-16T18:21:58Z' for tenant <TenatanID> and subscription <SubscriptionID>, waiting '60' seconds to run first scan

Configuration options

ossec.conf

  <office365>
    <enabled>yes</enabled>
    <interval>1m</interval>
    <curl_max_size>1M</curl_max_size>
    <only_future_events>no</only_future_events>
    <api_auth>
        <tenant_id>tenant_id</tenant_id>
        <client_id>client_id</client_id>
        <client_secret>client_secret</client_secret>
    </api_auth>
    <subscriptions>
        <subscription>Audit.SharePoint</subscription>
        <subscription>Audit.AzureActiveDirectory</subscription>
        <subscription>Audit.Exchange</subscription>
        <subscription>Audit.General</subscription>
    </subscriptions>
  </office365>

Logs example

2022/06/22 21:55:20 wazuh-modulesd:office365[142854] wm_office365.c:472 at wm_office365_execute_scan(): DEBUG: Bookmark updated to '2022-06-23T00:55:18Z' for tenant '0fea4e03-8146-453b-b889-54b4bd11565b' and subscription 'Audit.SharePoint', waiting '60' seconds to run next scan.

• Compilation without warnings in every supported platform
  • Linux
  • Windows
  • MAC OS X
• Source installation
• Package installation
• Source upgrade
• Package upgrade
• Review logs syntax and correct language

• Memory tests for Linux
  • Coverity
  • Valgrind (memcheck and descriptor leaks check)

[sdvendramini]

LGTM!

[jmv74211]

QA review

• Type: Manual testing.
• Status: Approved 🟢
• Testing issue: Manual testing - Office365 integration scan messages enrichment wazuh-qa#3049
• Comments: Nothing to highlight. Everything seems to work properly.