M365EXO-043: User click tracking enabled (MS.EXO.15.3)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.15.3 recommends that user click tracking be enabled. Click tracking records when users click links in mail, providing after-the-fact visibility into whether a malicious link may have been visited. This is essential for scoping and responding to incidents involving phishing links.
Valor recomendado
Safe Links (or comparable) policy with click tracking enabled (DoNotTrackUserClicks = False)
Remediación
Ensure user click tracking is enabled in the Safe Links or comparable policy so that clicks on links in mail are recorded (the do-not-track option should be off). Apply the policy to all users. Confirm click telemetry is available in the relevant reporting surface for incident investigation.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, SI-4
- MITRE ATT&CK
- T1566.002