ORCA.105 - Safe Links Synchronous URL detonation is enabled.
Overview
When the 'Wait for URL scanning to complete before delivering the message' option is configured, messages that contain URLs to be scanned will be held until the URLs finish scanning and are confirmed to be safe before the messages are delivered.
Remediation action
Enable Safe Links Synchronous URL detonation.
Related Links
- Microsoft 365 Defender Portal - Safe links
- Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security
- Set up Microsoft Defender for Office 365 Safe Links policies
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.105 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.002 Spearphishing Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA105 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.105.ps1 - Documentation:
tests/orca/Test.ORCA.105.md