M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.17.1 requires that Microsoft Purview Audit (Standard) logging, the unified audit log, be enabled. The unified audit log captures user and admin activity across Microsoft 365 and is foundational for incident response and threat detection. If unified audit log ingestion is disabled, activity evidence is not collected and investigations are severely hampered.
Valor recomendado
Unified audit log ingestion enabled (UnifiedAuditLogIngestionEnabled = True)
Remediación
Verify that unified audit log ingestion is enabled (UnifiedAuditLogIngestionEnabled = True) so user and admin activity is captured in the Microsoft 365 audit log. If disabled, enable it via the audit log configuration. Confirm logging is active by querying for recent events after enabling.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.DEFENDER.6.1v1
- NIST SP 800-53
- AU-2, AU-3, AU-12
- MITRE ATT&CK
- T1562.008