Detections
Analytics

MS.DEFENDER.5.1v1 - At a minimum, the alerts required by the CISA M365 Secure Configuration Baseline for Exchange Online SHALL be enabled.

Information

Potentially malicious or service-impacting events may go undetected without a means of detecting these events. Administrators are alerted to these events when they occur, minimizing potential user or agency impact.

Solution

1. Sign in to Microsoft 365 Defender.

2. Under Email & collaboration, select Policies & rules.

3. Select Alert Policy.

4. Select the checkbox next to each alert to enable as determined by the
 agency and at a minimum those referenced in the
 [_CISA M365 Secure Configuration Baseline for Exchange Online_](./exo.md#msexo161v1) which are:

 a. Suspicious email sending patterns detected.

 b. Suspicious connector activity.

 c. Suspicious Email Forwarding Activity.

 d. Messages have been delayed.

 e. Tenant restricted from sending unprovisioned email.

 f. Tenant restricted from sending email.

 g. A potentially malicious URL click was detected.

5. Click the pencil icon from the top menu.

6. Select the Enable selected policies action from the Bulk actions
 menu.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4(5)

Plugin: microsoft_azure

Control ID: d91e71ecb221063aa9a451005d8b4180cc3de11c8ea0e39599808f5a2975b7ca