ORCA.242 - Important protection alerts responsible for AIR activities are enabled.
Overview
Automated Incident Response (AIR) triggers off certain alerts that fire in the environment. AIR is responsible for detecting further anomalies and providing automated remediation actions designed to mitigate threats/attacks. It is important that these alerts are enabled so that AIR can function correctly.
Remediation action
Enable important protection alerts that are responsible for AIR activities.
Related Links
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.242 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Tenant settings |
| Area | Logging and detection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports controls | nist-800-53-r5:SI-4(5) |
| PowerShell test | Test-ORCA242 |
| Services | ExchangeOnline, SecurityCompliance |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.242.ps1 - Documentation:
tests/orca/Test.ORCA.242.md