Implement Security Suite group 6

[mitchelbaker-cisa]

🗣 Description

Implements Security Suite group 6 for Inbound Anti-Spam Protections policies. Rego rulesets were added that handle default, standard/strict presets, and custom policies. It also handles the precedence for how the anti-spam policies are checked: strict preset -> standard preset -> custom -> default. New rego unit tests and functional tests are included as well.

💭 Motivation and context

Closes #2107

🧪 Testing

Tested against all four test tenants, modified different email classifications to check pass/fail states for Security Suite 6.1 and 6.2.

Run unit tests locally:

.\Testing\RunRegoUnitTests.ps1 -p securitysuite -c 6

Run functional tests locally:

$TestContainers = @() 
$TestContainers += New-PesterContainer -Path "../ScubaGear/Testing/Functional/Products/" `
-Data @{ 
    Thumbprint = "<thumbprint>";
    TenantDomain = "<domain>"; 
    TenantDisplayName = "<display name>"; 
    AppId = "<app id>";
    ProductName = "securitysuite"; 
    M365Environment = "gcc";
} 
$PesterConfig = @{
    Run = @{Container = $TestContainers}
    Filter = @{Tag = @("MS.SECURITYSUITE.6.1v1")}
    Output = @{Verbosity = 'Detailed'}
}

$Config = New-PesterConfiguration -Hashtable $PesterConfig 
Invoke-Pester -Configuration $Config

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• PR/feature branch passes functional tests for relevant products, if applicable.

• Feature branch has been rebased against changes from parent branch, as needed.

  Use Update branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch.

• Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Close issues resolved by this PR if the closing keywords did not activate.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[adhilto]

I've just review 6.1 so far, but some initial feedback:

We need to check the recipients of a policy to make sure it applies to all recipients. For example, I made it so that the strict preset policy applies to only me and no one else, and 6.1 passed. It should check the other policies in this case because the strict policy isn't really active. Devesh added some helper functions that can help with this:

• To check if a preset policy covers everyone:

  ScubaGear/PowerShell/ScubaGear/Rego/Utils/SecuritySuite.rego

  Line 80 in 79a21d2

  PresetPolicyCoversAllRecipients(Identity) if {

• To check if a custom policy covers everyone:

  ScubaGear/PowerShell/ScubaGear/Rego/Utils/SecuritySuite.rego

  Line 102 in 79a21d2

  CustomRuleCoversAllRecipients(Rule) if {

• No need to check this for the default policy as this applies to all

[adhilto]

Looks good!

[mitchelbaker-cisa]

@JosephRWalter Resolved the issue with the -AddXHeaderValue parameter not being set, which impacted test tenants that didn't already have this field configured. See this functional test run for more info: https://github.com/cisagov/ScubaGear/actions/runs/28263423825/job/83745557160 (contains failures for section 2 which a separate PR is handling)

[JosephRWalter]

I retested the functional tests locally, everything passed as expected. I also tested all of the products against the 4 tenants using both interactive and non-interactive logins, ScubaGear executed as expected.

No issues.