O365 message trace detections: support o365:graph:messagetrace (Office 365 add-on 6.x)

[sbaker-gre]

Fixes #4285.

Splunk Add-on for Microsoft Office 365 6.x emits message trace as o365:graph:messagetrace
with camelCase fields. The four message trace detections and their macro only handled the
retired Reporting web service sourcetypes and PascalCase raw fields, so they return nothing
on a current add-on.

Changes

• macros/o365_messagetrace.yml: add o365:graph:messagetrace.
• Four detections switched from raw fields to the CIM fields the add-on aliases for both
  sourcetypes: Status → status_code, RecipientAddress → recipient,
  SenderAddress → src_user, MessageId → message_id. Drilldowns updated to match.
• Organization (absent on the Graph sourcetype) replaced with a sender-domain vs
  recipient-domain comparison in the two exfiltration-style detections.
• Second unit test per detection using the Graph fixture from T1114 o365_suspect_email_actions: add Graph message trace fixture attack_data#1224.
  Legacy test retained to prove backward compatibility with o365:reporting:messagetrace.
• Versions bumped.
• description, how_to_implement and known_false_positives reflowed to |- block
  scalars, one sentence per line, to match repo style. No content changes.

Detections

• O365 Email Password and Payroll Compromise Behavior
• O365 Email Receive and Hard Delete Takeover Behavior
• O365 Email Send and Hard Delete Exfiltration Behavior
• O365 Email Send Attachments Excessive Volume

Verification

• contentctl-ng build passes.
• On live o365:graph:messagetrace data (add-on 6.0.2), all five CIM fields are populated
  on 2,000 of 2,000 sampled events. Graph status values are lowercase (delivered);
  the status_code=Delivered filter is in the base search where value matching is
  case-insensitive, so it matches both.
• The Graph unit tests depend on the attack_data PR merging first.

🤖 Generated with Claude Code

[nasbench]

Tested the updates locally. See SS below and check count being doubled

[nasbench]

The updates LGTM. For context I looked at the props and the mapping is technically the same. Here it is below for reference.

[o365:reporting:messagetrace]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = 0
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%Q
TZ = UTC
TIME_PREFIX = "Received": "
REPORT-splunk_ta_o365_cim_all_email_domain = extract_messagetrace_src_user_domain, extract_messagetrace_recipient_domain
FIELDALIAS-o365_reporting_messagetrace_basic_alias_recipient = RecipientAddress AS recipient
FIELDALIAS-o365_reporting_messagetrace_basic_alias_src_user = SenderAddress AS src_user
FIELDALIAS-o365_reporting_messagetrace_basic_alias_dest = ToIP AS dest
FIELDALIAS-o365_reporting_messagetrace_basic_alias_src = FromIP AS src
FIELDALIAS-o365_reporting_messagetrace_basic_alias_message_id = MessageId AS message_id
FIELDALIAS-o365_reporting_messagetrace_basic_alias_subject = Subject AS subject
FIELDALIAS-o365_reporting_messagetrace_basic_alias_size = Size AS size
FIELDALIAS-o365_reporting_messagetrace_basic_alias_internal_message_id = MessageTraceId AS internal_message_id
FIELDALIAS-o365_reporting_messagetrace_basic_alias_status_code = Status AS status_code
EVAL-vendor_product = "Microsoft Office 365 MessageTrace"
EVAL-recipient_count = "1"
LOOKUP-splunk_ta_o365_cim_messagetrace_action = splunk_ta_o365_cim_messagetrace_action Status OUTPUT action

[o365:graph:messagetrace]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = 0
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7N
TZ = UTC
TIME_PREFIX = "receivedDateTime": "
REPORT-splunk_ta_o365_cim_all_email_domain = extract_graph_messagetrace_src_user_domain, extract_graph_messagetrace_recipient_domain
FIELDALIAS-o365_graph_messagetrace_recipient = recipientAddress AS recipient
FIELDALIAS-o365_graph_messagetrace_src_user = senderAddress AS src_user
EVAL-toIP = if(toIP!="", toIP, null())
EVAL-dest = if(toIP!="", toIP, null())
FIELDALIAS-o365_graph_messagetrace_src = fromIP AS src
FIELDALIAS-o365_graph_messagetrace_message_id = messageId AS message_id
FIELDALIAS-o365_graph_messagetrace_subject = subject AS subject
FIELDALIAS-o365_graph_messagetrace_size = size AS size
FIELDALIAS-o365_graph_messagetrace_internal_message_id = id AS internal_message_id
FIELDALIAS-o365_graph_messagetrace_status_code = status AS status_code
EVAL-vendor_product = "Microsoft Office 365 MessageTrace"
EVAL-recipient_count = "1"
LOOKUP-splunk_ta_o365_cim_graph_messagetrace_action = splunk_ta_o365_cim_graph_messagetrace_action status OUTPUT action

I have also ran these searches locally and they work