ORCA.220 - Advanced Phish filter Threshold level is adequate.
Overview
The higher the Advanced Phishing Threshold Level, the stricter the mechanisms are that detect phishing attempts against your users.
Remediation action
Set Advanced Phish filter Threshold to 3 or 4.
Related Links
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.220 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA220 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.220.ps1 - Documentation:
tests/orca/Test.ORCA.220.md