Port 3 BEC-relevant Sagan Cloud rules to legacy (skip BAV2ROPC)

[bryant-smith]

Summary

• Ports 3 of 4 candidate sagan-cloud-rules BEC/O365 detections to legacy .rules, identified via a legacy-vs-cloud BEC coverage comparison and validated for noise against Grafana alert history (YTD 2026, all customers):
  • 5017957/5017958 (msapi-azuread.rules) — ungated illicit OAuth consent-grant / delegated-permission-grant detection, porting cloud 600548/600599. Legacy's existing consent rules (5004804/5004837) only fire from outside HOME_COUNTRY or a Bluedot-listed IP — a same-country, clean-IP grant was previously invisible.
  • 5017959/5017960 (new msapi-microsoftteams.rules) — Teams archive-file / multi-file exfil to foreign tenant users, porting cloud 6005331/6005332.
• Deliberately excludes cloud 6005257 (Legacy Auth / BAV2ROPC) — Grafana showed 2,290 hits YTD across 17 tenants, by far the noisiest of the four candidates. Needs a suppression pass before it's portable, not a straight 1:1 port.

Known limitations (flagged inline in the rule comments)

• ModifiedProperties (consent rules) and MessageFiles (Teams rules) are JSON arrays in the source UAL records. The legacy engine never expands JSON arrays via json_content/json_map, so the scope/file checks use plain content/pcre substring matching on the raw record instead of a structured field path — same technique already used elsewhere in msapi-azuread.rules for array-nested fields (e.g. the named-role rules).
• .ParticipantInfo.HasForeignTenantUsers is 38 characters, over the engine's 31-char key-truncation limit (JSON_MAX_KEY_SIZE=32), so both Teams rules use the truncated key .ParticipantInfo.HasForeignTena, following the established fix pattern from sagan-rules#704.
• Cloud's array-length count (MessageFiles[] ≥6) and ChatThreadId-based rate limiting can't be reproduced in legacy (no array counting, no arbitrary track_by field), so both Teams rules substitute a by_username rate as an approximation — flagged as such, not a literal port.

Test plan

• python3 / repo lint check for duplicate SIDs and rule syntax (ran locally — no collisions against existing alert lines)
• Replay against a real Entra/O365 consent-grant and Teams file-share log fixture before enabling in production (none of the 4 new rules have been fired against real telemetry yet)
• Confirm ConsentAction.Permissions / DelegatedPermissionGrant.Scope / MessageFiles literal substrings actually appear as expected in a live UAL record for this ingest pipeline

🤖 Generated with Claude Code

https://claude.ai/code/session_01RHYEbkU9keVovW9UAACgsX