M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.16.1 requires that a minimum set of alerts be enabled, including suspicious email sending patterns, suspicious connector activity, suspicious email forwarding activity, messages delayed, tenant restricted from sending unprovisioned email, tenant restricted from sending email, and a potentially malicious URL click detected. These alerts give administrators real-time insight into likely security incidents.
Valor recomendado
The seven required alert policies enabled: suspicious sending patterns, suspicious connector activity, suspicious forwarding, messages delayed, tenant restricted from sending unprovisioned email, tenant restricted from sending email, malicious URL click
Remediación
Verify each of the seven required alert policies is enabled: suspicious email sending patterns, suspicious connector activity, suspicious email forwarding activity, messages have been delayed, tenant restricted from sending unprovisioned email, tenant restricted from sending email, and a potentially malicious URL click was detected. Enable any that are disabled. Where a comparable third-party alerting solution is used, confirm it covers equivalent conditions.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| empty | FAIL |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.DEFENDER.5.1v1
- NIST SP 800-53
- SI-4, IR-4, AU-6
- MITRE ATT&CK
- T1114.003