CISA.MS.EXO.16.2 - Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Overview

Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.

Rationale: Suspicious or malicious events, if not resolved promptly, may have a greater impact to users and the agency. Sending alerts to a monitored email address or SIEM system helps ensure these suspicious or malicious events are acted upon in a timely manner to limit overall impact.

Remediation action:

1. Sign in to Microsoft 365 Defender.
2. Select Settings.
3. Select either:
   • Microsoft Sentinel.
   • Defender XDR, and under General, select Streaming API.
4. Ensure a SIEM integration is configured for your organization.

Related links

• Defender admin center - Alert policy
• Defender admin center - Streaming API
• Defender admin center - Sentinel workspaces
• CISA 16 Alerts - MS.EXO.16.2
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.16.2
Severity	Medium
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Alert policies
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.16.2
Criticality	SHOULD
Upstream requirement	Moved to MS.SECURITYSUITE.4.2v1 (was MS.EXO.16.2v1)
Supports controls	cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)
PowerShell test	Test-MtCisaExoAlertSiem
Services	ExchangeOnline, Graph, SecurityCompliance
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.16.2.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.16.2.md