Michael Soule
Co-creator of Maester
Tests authored
- AD-CFG-01Tombstone lifetime configuration should be retrievable
- AD-CFG-02dSHeuristics count should be retrievable
- AD-CFG-03SPN mappings should be retrievable
- AD-CFG-04Optional features count should be retrievable
- AD-CFG-05Recycle bin enabled paths should be retrievable
- AD-CFG-06LDAP query policy count should be retrievable
- AD-CFG-07Default query policy should be retrievable
- AD-CFG-08AuthN policy container count should be retrievable
- AD-CFG-09AD activation objects count should be retrievable
- AD-CFG-10Well-known security principals count should be retrievable
- AD-CFG-11Registered DHCP servers count should be retrievable
- AD-CFG-12Enterprise CA count should be retrievable
- AD-CFG-13Certificate templates count should be retrievable
- AD-CFG-14Enrollment templates count should be retrievable
- AD-CFG-15Enrollment CA certificate details should be retrievable
- AD-CFG-16Trusted root CA count should be retrievable
- AD-CFG-17Trusted root CA details should be retrievable
- AD-CFG-18Intermediate CA count should be retrievable
- AD-CFG-19Intermediate CA details should be retrievable
- AD-CFG-20CRL distribution points count should be retrievable
- AD-CFG-21NTAuth certificates count should be retrievable
- AD-CFG-22KDS root keys count should be retrievable
- AD-CFG-23SMTP site links count should be retrievable
- AD-CFG-24IP site links count should be retrievable
- AD-COMP-01Computer disabled count should be retrievable
- AD-COMP-02Computer dormant count should be retrievable
- AD-COMP-03Computer CreatorSid count should be retrievable
- AD-COMP-04Computer non-standard primary group count should be retrievable
- AD-COMP-05Computer SID History count should be retrievable
- AD-COMP-06Computer default container count should be retrievable
- AD-COMP-07Computer OU count should be retrievable
- AD-COMP-08Computer per OU average should be retrievable
- AD-COMP-09Computer delegation count should be retrievable
- AD-COMP-10Computer delegation details should be retrievable
- AD-DACL-01Distinct DACL object count should be investigated
- AD-DACL-02OU DACL entry count should be investigated
- AD-DACL-03Conflict object count should be investigated
- AD-DACL-04Conflict object details should be investigated
- AD-DACL-05Deny ACE count should be investigated
- AD-DACL-06Deny ACE details should be investigated
- AD-DACL-07Distinct DACL identity count should be investigated
- AD-DACL-08DACL ACE distribution per identity should be investigated
- AD-DACL-09Privileged allow ACE count should be investigated
- AD-DACL-10Privileged allow ACE details should be investigated
- AD-DACL-11Privileged extended right count should be investigated
- AD-DACL-12Privileged extended right details should be investigated
- AD-DACL-13Privileged extended right identities should be investigated
- AD-DACL-14Non-inherited ACE count should be investigated
- AD-DACL-15Unresolved SID count should be investigated
- AD-DACL-16Unresolved SID details should be investigated
- AD-DACL-17Inherited object type count should be investigated
- AD-DACL-18Inherited object type details should be investigated
- AD-DC-01DC site coverage count should be retrievable
- AD-DC-02SMBv1 should be disabled on all domain controllers
- AD-DC-03SMBv3.1.1 enabled count should be retrievable
- AD-DC-04SMB signing should be enabled on all domain controllers
- AD-DC-05DCs with all FSMO roles count should be retrievable
- AD-DC-06FSMO role holder details should be retrievable
- AD-DC-07DC operating system count should be retrievable
- AD-DC-08DC operating system details should be retrievable
- AD-DCD-01DC non-standard LDAP port count should be retrievable
- AD-DCD-02DC non-standard LDAPS port count should be retrievable
- AD-DCD-03Read-only domain controller count should be retrievable
- AD-DCD-04Non-Global Catalog DC count should be retrievable
- AD-DCOMP-01Computers with unconstrained delegation count should be investigated
- AD-DCOMP-02Non-DC computers should not have unconstrained delegation
- AD-DCOMP-03Non-DC computers with constrained delegation count should be investigated
- AD-DCOMP-04Computer operating system count should be investigated
- AD-DCOMP-05Computer operating system details should be investigated
- AD-DCOMP-06No enabled computers should be stale for 180 days or more
- AD-DCOMP-07Computer DNS host name count should be investigated
- AD-DCOMP-08Computer DNS zone count should be investigated
- AD-DCOMP-09Computer DNS zone details should be investigated
- AD-DFSR-01All domain controllers should have DFS-R subscriptions
- AD-DNS-01DNS zone count should be retrievable
- AD-DNS-02Zones with only SOA/NS records should be retrievable
- AD-DNS-03Root servers with incorrect IPs should be retrievable
- AD-DNS-04Root server incorrect IP details should be retrievable
- AD-DNS-05Dynamic DNS record count should be retrievable
- AD-DNS-06Zones with non-default records should be retrievable
- AD-DNS-07Zone record count details should be retrievable
- AD-DNS-08Zone delegation count should be retrievable
- AD-DNS-09Zone delegation details should be retrievable
- AD-DNS-10SOA record details should be retrievable
- AD-DNS-11AD DS SRV record count should be retrievable
- AD-DNS-12AD DS SRV record details should be retrievable
- AD-DNS-13DNSSEC record count should be retrievable
- AD-DNS-14Empty zone count should be retrievable
- AD-DNS-15Duplicate zone count should be retrievable
- AD-DNS-16Reverse lookup zone count should be retrievable
- AD-DNS-17Non-standard zone count should be retrievable
- AD-DNS-18Reverse zone network count should be retrievable
- AD-DNS-19Reverse zone network details should be retrievable
- AD-DOM-01Domain functional level should be retrievable
- AD-DOM-02Machine account quota should be retrievable
- AD-DOM-03Domain controller count should be retrievable
- AD-DOM-04RIDs remaining should be retrievable
- AD-DOM-05Domain name standard compliance should be retrievable
- AD-DOM-06Domain name non-standard details should be retrievable
- AD-DOM-07NetBIOS name standard compliance should be retrievable
- AD-DOM-08NetBIOS name non-standard details should be retrievable
- AD-DOMS-01Allowed DNS suffixes count should be retrievable
- AD-FEAT-01Optional feature count should be investigated
- AD-FEAT-02Optional feature enabled details should be investigated
- AD-FGPP-01Fine-grained password policy count should be retrievable
- AD-FGPP-02Fine-grained password policy value count should be retrievable
- AD-FGPP-03Fine-grained password policy setting counts should be retrievable
- AD-FGPP-04Fine-grained password policy application targets should be retrievable
- AD-FOR-01Forest functional level should be retrievable
- AD-FOR-02Forest domain count should be retrievable
- AD-FOR-03Tombstone lifetime should be retrievable
- AD-FOR-04Recycle Bin status should be retrievable
- AD-FORS-01UPN suffixes count should be retrievable
- AD-FORS-02UPN suffixes details should be retrievable
- AD-FORS-03SPN suffixes count should be retrievable
- AD-FORS-04Cross-forest references count should be retrievable
- AD-GCHG-01Average group membership changes per year should be investigated
- AD-GMC-01Distinct groups with members count should be retrievable
- AD-GMC-02Distinct account types of members count should be retrievable
- AD-GMC-03Member account types breakdown should be retrievable
- AD-GMC-04Trust members count should be investigated
- AD-GMC-05Trust members details by group should be investigated
- AD-GMC-06Foreign SID principals count should be investigated
- AD-GMC-07Foreign SID details by domain should be investigated
- AD-GMC-08Empty non-privileged group count should be investigated
- AD-GMC-09Empty non-privileged group details should be investigated
- AD-GMC-10Privileged groups with members count should be investigated
- AD-GMC-11Privileged groups with members details should be investigated
- AD-GPO-01GPO total count should be retrievable
- AD-GPO-02GPO created before 2020 count should be retrievable
- AD-GPO-03GPO stale-before-2020 count should be investigated
- AD-GPO-04Unlinked GPO count should be compliant
- AD-GPO-05GPO unlinked details should be compliant
- AD-GPOL-01GPO linked count should be investigated
- AD-GPOL-02Disabled GPO link count should be retrievable
- AD-GPOL-03GPO unlinked target count should be compliant
- AD-GPOL-04Enforced GPO link count should be retrievable
- AD-GPOL-05GPO blocked inheritance count should be compliant
- AD-GPOL-06GPO linked OU count should be retrievable
- AD-GPOREP-01No GPOs should be missing permissions
- AD-GPOREP-02No GPOs should be missing permissions
- AD-GPOREP-03GPOs without authenticated users count should be retrievable
- AD-GPOREP-04GPOs without authenticated users details should be retrievable
- AD-GPOREP-05GPOs without enterprise domain controllers count should be retrievable
- AD-GPOREP-06GPOs without domain computers count should be retrievable
- AD-GPOREP-07GPOs with deny ACE count should be retrievable
- AD-GPOREP-08GPOs with deny ACE details should be retrievable
- AD-GPOREP-09GPO inherited permissions count should be retrievable
- AD-GPOREP-10GPO no-apply Group Policy ACE count should be investigated
- AD-GPOREP-11GPO no-apply Group Policy ACE details should be investigated
- AD-GPOREP-12GPO disabled link count should be retrievable
- AD-GPOREP-13GPO disabled link details should be investigated
- AD-GPOREP-14GPO enforcement count should be investigated
- AD-GPOREP-15No GPOs should have version mismatches
- AD-GPOREP-16No GPOs should have version mismatches
- AD-GPOREP-17No GPOs should contain a cpassword
- AD-GPOREP-18No GPOs should contain a cpassword
- AD-GPOREP-19No GPOs should contain a default password
- AD-GPOREP-20No GPOs should contain a default password
- AD-GPOS-01GPO state total count should be investigated
- AD-GPOS-02WMI filter count should be investigated
- AD-GPOS-03WMI filter details should be investigated
- AD-GPOS-04Disabled GPO settings count should be investigated
- AD-GPOS-05Computer disabled GPO settings details should be investigated
- AD-GPOS-06User disabled GPO settings details should be investigated
- AD-GPOS-07All disabled GPO settings details should be investigated
- AD-GPOS-08GPO owner distinct count should be investigated
- AD-GPOS-09GPO owner details should be investigated
- AD-GRP-01Group AdminCount should be retrievable
- AD-GRP-02Groups in container objects count should be retrievable
- AD-GRP-03Stale groups count should be retrievable
- AD-GRP-04Groups with manager count should be retrievable
- AD-GRP-05Group SID History count should be retrievable
- AD-GRP-06Distribution group count should be retrievable
- AD-GRP-07Security group count should be retrievable
- AD-GRP-08Domain local group count should be retrievable
- AD-GRP-09Global group count should be retrievable
- AD-GRP-10Universal group count should be retrievable
- AD-KRBTGT-01KRBTGT password age should not exceed 180 days
- AD-KRBTGT-02KRBTGT last logon should be investigated
- AD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)
- AD-MSA-01Managed service account count should be investigated
- AD-OU-01OU overlapping name count should be retrievable
- AD-OU-02OU at domain root count should be retrievable
- AD-OU-03OU stale count should be retrievable
- AD-OU-04OU empty count should be retrievable
- AD-OU-05OU empty details should be retrievable
- AD-PRINT-01Printer total count should be retrievable
- AD-PWDPOL-01Password history count should be retrievable
- AD-PWDPOL-02Password maximum age should be retrievable
- AD-PWDPOL-03Password minimum length should be retrievable
- AD-PWDPOL-04Password complexity requirement should be retrievable
- AD-PWDPOL-05Password reversible encryption status should be retrievable
- AD-PWDPOL-06Account lockout duration should be retrievable
- AD-PWDPOL-07Account lockout threshold should be retrievable
- AD-REPL-01No replication connections should be disabled
- AD-REPL-02Non-auto replication connection count should be investigated
- AD-ROOTDSE-01Supported SASL mechanism count should be investigated
- AD-ROOTDSE-02Supported SASL mechanism details should be investigated
- AD-ROOTDSE-03Root DSE should be synchronized
- AD-SCH-01Schema modification year count should be retrievable
- AD-SCH-02Schema modification year details should be retrievable
- AD-SCH-03Schema version entry count should be retrievable
- AD-SCH-04Schema version details should be retrievable
- AD-SCH-05LAPS should be installed in Active Directory
- AD-SITE-01Site total count should be retrievable
- AD-SITE-02Sites without domain controllers count should be retrievable
- AD-SITE-03Sites without domain controllers details should be retrievable
- AD-SITE-04Sites without subnet associations count should be retrievable
- AD-SITE-05Sites without subnet associations details should be retrievable
- AD-SPN-01Computer SPN service class count should be retrievable
- AD-SPN-02Computer SPN service class usage should be retrievable
- AD-SPN-03Computer SPN unknown service class count should be retrievable
- AD-SPN-04Computer SPN unknown service class details should be investigated
- AD-SPN-05Computer SPN non-FQDN hosts should be investigated
- AD-SPN-06User SPN total count should be investigated
- AD-SPN-07User SPN service class count should be investigated
- AD-SPN-08User SPN service class usage should be investigated
- AD-SPN-09User SPN unknown service class count should be investigated
- AD-SPN-10User SPN unknown service class details should be investigated
- AD-SPN-11User SPN non-FQDN hosts should be investigated
- AD-SPN-12No domain admin accounts should have SPNs configured
- AD-SPN-13No domain admin accounts should have SPNs configured
- AD-SUB-01Subnet total count should be retrievable
- AD-SUB-02Sites with subnet associations count should be retrievable
- AD-SUB-03Catch-all subnets count should be retrievable
- AD-SUB-04IPv6 subnets count should be retrievable
- AD-SUB-05IPv6 catch-all subnets count should be retrievable
- AD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievable
- AD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievable
- AD-SUB-08Distinct first octets count should be retrievable
- AD-SUB-09Distinct first two octets (/16 networks) count should be retrievable
- AD-SUB-10Distinct first three octets (/24 networks) count should be retrievable
- AD-SUB-11Subnets without site associations count should be retrievable
- AD-TRUST-01Trust total count should be investigated
- AD-TRUST-02Trust inter-forest count should be investigated
- AD-TRUST-03Trust quarantined count should be investigated
- AD-TRUST-04No trusts should lack SID filtering (quarantine)
- AD-TRUST-05Trust configuration details should be investigated
- AD-TRUST-06Trust stale count should be investigated
- AD-TRUST-07Trust stale details should be investigated
- AD-USER-01Disabled user count should be retrievable
- AD-USER-02Dormant enabled user count should be retrievable
- AD-USER-03Non-expiring password user count should be retrievable
- AD-USER-04Reversible encryption user count should be retrievable
- AD-USER-05Delegation-enabled user count should be retrievable
- AD-USER-06DES-only Kerberos user count should be retrievable
- AD-USER-07No pre-authentication user count should be retrievable
- AD-USER-08Never-logged-in enabled user count should be retrievable
- AD-USER-09Password-not-required user count should be retrievable
- AD-USER-10Workstation-restricted user count should be retrievable
- AD-USER-11User AdminCount count should be retrievable
- AD-USER-12User non-standard primary group count should be retrievable
- AD-USER-13User SID History count should be retrievable
- AD-USER-14User SPN count should be retrievable
- AD-USER-15User manager count should be retrievable
- AD-USER-16User home directory count should be retrievable
- AD-USER-17User profile path count should be retrievable
- AD-USER-18User script path count should be retrievable
- AD-USER-19User in container count should be retrievable
- AD-USER-20Known service account count should be retrievable
- AD-USER-21Known service account details should be investigated
- AD-USER-22Built-in administrator account count should be investigated
- AD-USER-23Enabled built-in administrator details should be investigated
- AD-USER-24Built-in administrator last logon details should be investigated
- AD-USER-25Built-in administrator password age details should be investigated
- AD-USER-26Honey pot user count should be investigated
- AD-USER-27Honey pot user details should be investigated
- AD-USER-28User delegation configured count should be investigated
- AD-USER-29No users should be configured for unconstrained delegation
- CIS.M365.1.1.1(L1) Ensure Administrative accounts are cloud-only
- CIS.M365.1.3.3(L2) Ensure 'External sharing' of calendars is not available
- CISA.MS.AAD.1.1Legacy authentication SHALL be blocked.
- CISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.
- CISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.
- CISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.
- CISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.
- CISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.
- CISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.
- CISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.
- CISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.
- CISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.
- CISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.
- CISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.
- CISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.
- CISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.
- CISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.
- CISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.
- CISA.MS.AAD.5.4Group owners SHALL NOT be allowed to consent to applications.
- CISA.MS.AAD.6.1User passwords SHALL NOT expire.
- CISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
- CISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.
- CISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.
- CISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
- CISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.
- CISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.
- CISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.
- CISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.
- CISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.
- CISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.
- CISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.
- CISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
- CISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.
- CISA.MS.EXO.2.1A list of approved IP addresses for sending mail SHALL be maintained.
- CISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.
- CISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.
- CISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.
- CISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.
- CISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov.
- CISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.
- CISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.
- CISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.
- CISA.MS.EXO.7.1External sender warnings SHALL be implemented.
- CISA.MS.EXO.8.1A DLP solution SHALL be used.
- CISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.
- CISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.
- CISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.
- CISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.
- CISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.
- CISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.
- CISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.
- CISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).
- CISA.MS.EXO.10.1Emails SHALL be scanned for malware.
- CISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.
- CISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.
- CISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.
- CISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.
- CISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.
- CISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.
- CISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.
- CISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.
- CISA.MS.EXO.14.1A spam filter SHALL be enabled.
- CISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
- CISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.
- CISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.
- CISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.
- CISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.
- CISA.MS.EXO.15.3User click tracking SHOULD be enabled.
- CISA.MS.EXO.16.1Alerts SHALL be enabled.
- CISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.
- CISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.
- CISA.MS.EXO.17.2Microsoft Purview Audit (Premium) logging SHALL be enabled.
- CISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
- CISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
- CISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.
- MT.1076MOERA SHOULD NOT be used for sent mail
- ORCA.100Bulk Complaint Level threshold is between 4 and 6.
- ORCA.101Bulk is marked as spam.
- ORCA.102Advanced Spam filter options are turned off.
- ORCA.103Outbound spam filter policy settings configured.
- ORCA.104High Confidence Phish action set to Quarantine message.
- ORCA.105Safe Links Synchronous URL detonation is enabled.
- ORCA.106Quarantine retention period is 30 days.
- ORCA.107End-user spam notification is enabled.
- ORCA.108DKIM signing is set up for all your custom domains.
- ORCA.109Senders are not being allow listed in an unsafe manner.
- ORCA.110Internal Sender notifications are disabled.
- ORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.
- ORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.
- ORCA.113AllowClickThrough is disabled in Safe Links policies.
- ORCA.114No IP Allow Lists have been configured.
- ORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.
- ORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.
- ORCA.119Similar Domains Safety Tips is enabled.
- ORCA.121Supported filter policy action used.
- ORCA.123Unusual Characters Safety Tips is enabled.
- ORCA.124Safe attachments unknown malware response set to block messages.
- ORCA.139Spam action set to move message to junk mail folder or quarantine.
- ORCA.140High Confidence Spam action set to Quarantine message.
- ORCA.141Bulk action set to Move message to Junk Email Folder.
- ORCA.142Phish action set to Quarantine message.
- ORCA.143Safety Tips are enabled.
- ORCA.156Safe Links Policies are tracking when user clicks on safe links.
- ORCA.158Safe Attachments is enabled for SharePoint and Teams.
- ORCA.179Safe Links is enabled intra-organization.
- ORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.
- ORCA.189Safe Attachments is not bypassed.
- ORCA.205Common attachment type filter is enabled.
- ORCA.220Advanced Phish filter Threshold level is adequate.
- ORCA.221Mailbox intelligence is enabled in anti-phishing policies.
- ORCA.222Domain Impersonation action is set to move to Quarantine.
- ORCA.223User impersonation action is set to move to Quarantine.
- ORCA.224Similar Users Safety Tips is enabled.
- ORCA.225Safe Documents is enabled for Office clients.
- ORCA.226Each domain has a Safe Link policy applied to it.
- ORCA.227Each domain has a Safe Attachments policy applied to it.
- ORCA.228No trusted senders in Anti-phishing policy.
- ORCA.229No trusted domains in Anti-phishing policy.
- ORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.
- ORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.
- ORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.
- ORCA.233Domains are pointed directly at EOP or enhanced filtering is used.
- ORCA.234Click through is disabled for Safe Documents.
- ORCA.235SPF records is set up for all your custom domains.
- ORCA.236Safe Links is enabled for emails.
- ORCA.237Safe Links is enabled for teams messages.
- ORCA.238Safe Links is enabled for office documents.
- ORCA.239No exclusions for the built-in protection policies.
- ORCA.240Outlook is configured to display external tags for external emails.
- ORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.
- ORCA.242Important protection alerts responsible for AIR activities are enabled.
- ORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.
- ORCA.244Policies are configured to honor sending domains DMARC.