Detections
Analytics

MS.EXO.16.2v1 - The alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.

Information

Suspicious or malicious events, if not resolved promptly, may have a greater impact to users and the agency. Sending alerts to a monitored email address or SIEM system helps ensure these suspicious or malicious events are acted upon in a timely manner to limit overall impact.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Any product meeting the requirements outlined in this baseline policy may be
used. If the agency uses Microsoft 365 alert policies, see the following implementation steps to
[add email recipients to an alert](./defender.md#msdefender51v1-instructions)
for additional guidance.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4(12)

Plugin: microsoft_azure

Control ID: b9f13accc0ba743981c84676d4ec63b9b63725cd2a4dd2bccb4764bc62bf0309