M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.14.1 requires that a spam filter be enabled, comparable to the native spam filtering. Spam clutters mailboxes, reduces productivity, and often carries malicious links or attachments. An organization with no active inbound spam policy leaves users exposed to the full volume of unsolicited and potentially malicious mail.
Valor recomendado
At least one active hosted content (anti-spam) filter policy applied to all recipients
Remediación
Confirm at least one inbound anti-spam (hosted content filter) policy is active and applied to all recipients. If using a comparable third-party gateway, verify it is enabled for all inbound mail. Review spam action thresholds to ensure aggressive bulk and spam senders are filtered.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| empty | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566