feat(microsoft-defender-o365): mvp1/chk5 - register expectation signature types (#499)

[Megafredo]

Parent Issue: #499
Parent PR (MVP): #492

Contracts

Input Contract

7 total signature types must exist in or be contributable to the enum (3 standard types + 4 email placeholders waiting for the injector).

Output Contract

from pyoaev.signatures.types import SignatureTypes

SUPPORTED_SIGNATURES: list[SignatureTypes] = [
    # Standard signatures (from template)
    SignatureTypes.SIG_TYPE_START_DATE,
    SignatureTypes.SIG_TYPE_END_DATE,
    SignatureTypes.SIG_TYPE_PARENT_PROCESS_NAME,
    # Email-specific signatures (placeholder names — final names defined by injector)
    SignatureTypes.SIG_TYPE_MAIL_SOURCE_EMAIL,
    SignatureTypes.SIG_TYPE_MAIL_PLAYER_EMAIL,
    SignatureTypes.SIG_TYPE_MAIL_URL_HASH,
    SignatureTypes.SIG_TYPE_MAIL_ATTACHMENT_HASH,
]

Consumed by: Source(signatures=SUPPORTED_SIGNATURES) in the collector entry point (CHK.1 scaffold).

Acceptance Criteria

@signatures @oaev @microsoft-defender-o365

Feature: SUPPORTED_SIGNATURES declares all email-relevant signature types
  As a collector developer
  I want a canonical list of supported signature types
  So that the platform knows which expectation fields this collector can match against

  Scenario Outline: SUPPORTED_SIGNATURES contains each expected type
    When SUPPORTED_SIGNATURES is set
    Then the list contains <signature_type>

    Examples:
      | signature_type          |
      | SIG_TYPE_START_DATE     |
      | SIG_TYPE_END_DATE       |
      | SIG_TYPE_EMAIL_SUBJECT  |
      | SIG_TYPE_SENDER_DOMAIN  |
      | SIG_TYPE_SENDER_ADDRESS |
      | SIG_TYPE_THREAT_TYPE    |

  Scenario Outline: SUPPORTED_SIGNATURES contains no duplicate entries
    When SUPPORTED_SIGNATURES is set
    Then len(SUPPORTED_SIGNATURES) equals len(set(SUPPORTED_SIGNATURES))

    Examples:
      | expected_count |
      | 6              |

  Scenario Outline: get_expectation_signature_groups returns SUPPORTED_SIGNATURES
    Given a DefenderO365Collector instance
    When get_expectation_signature_groups is called
    Then the returned list equals SUPPORTED_SIGNATURES

    Examples:
      | method_name                      |
      | get_expectation_signature_groups |

Done Checklist

• Create src/source/defender_o365_signatures.py with SUPPORTED_SIGNATURES
• Populate with 7 SignatureTypes values (3 standard + 4 email placeholders)
• Write unit tests: all 7 types present, no duplicates, all are valid SignatureTypes
• Create a dedicated PR linked to the Umbrella issue

Closes #499

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
288	1	287	0

View the full list of 1 ❄️ flaky test(s)

::tests.test_openaev_microsoft_defender

Flake rate in main: 100.00% (Passed 0 times, Failed 3 times)

Stack Traces | 0s run time

../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../site-packages/_pytest/python.py:508: in importtestmodule
    mod = import_path(
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../site-packages/_pytest/pathlib.py:596: in import_path
    importlib.import_module(module_name)
.../hostedtoolcache/Python/3.13.14.../x64/lib/python3.13/importlib/__init__.py:88: in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
<frozen importlib._bootstrap>:1395: in _gcd_import
    ???
<frozen importlib._bootstrap>:1360: in _find_and_load
    ???
<frozen importlib._bootstrap>:1331: in _find_and_load_unlocked
    ???
<frozen importlib._bootstrap>:935: in _load_unlocked
    ???
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../_pytest/assertion/rewrite.py:188: in exec_module
    exec(co, module.__dict__)
tests/test_openaev_microsoft_defender.py:77: in <module>
    from microsoft_defender.openaev_microsoft_defender import (
microsoft_defender/openaev_microsoft_defender.py:12: in <module>
    from msgraph import GraphServiceClient
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../site-packages/msgraph/__init__.py:5: in <module>
    from .graph_request_adapter import GraphRequestAdapter
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../site-packages/msgraph/graph_request_adapter.py:3: in <module>
    from kiota_abstractions.authentication import AuthenticationProvider
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../kiota_abstractions/authentication/__init__.py:3: in <module>
    from .anonymous_authentication_provider import AnonymousAuthenticationProvider
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../kiota_abstractions/authentication/anonymous_authentication_provider.py:9: in <module>
    from ..request_information import RequestInformation
../../../../......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../site-packages/kiota_abstractions/request_information.py:17: in <module>
    from opentelemetry import trace
E     File "/home/runner/......./pypoetry/virtualenvs/openaev-microsoft-defender-collector-ysPYSAA0-py3.13/lib/python3.13.../opentelemetry/trace/__init__.py", line 669
E       ]
E       ^
E   SyntaxError: unmatched ']'

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}