M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.13.1 requires that mailbox auditing be enabled. Mailbox auditing records actions taken on mailbox contents by owners, delegates, and administrators, providing essential forensic evidence for investigating compromise. Although enabled by default, this control guards against inadvertent or malicious disabling at the organization level.
Valor recomendado
Organization AuditDisabled = False so mailbox auditing is enabled tenant-wide
Remediación
Verify that mailbox auditing is enabled organization-wide by confirming AuditDisabled is False on the organization configuration. If auditing is disabled, re-enable it and investigate why it was turned off to rule out tampering. Confirm the default audited actions cover MailItemsAccessed, Send, SoftDelete, and HardDelete across logon types.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.EXO.13.1v1
- NIST SP 800-53
- AU-2, AU-3
- MITRE ATT&CK
- T1114