Rec: 2.1.1 - Validate Test-SafeLinksOfficeApps.ps1, ELevel: E5, ProfileLevel: L2, IG1: TRUE, IG2: TRUE, IG3: TRUE, Connection: EXO

[DrIOSX]

Validation for Test-SafeLinksOfficeApps.ps1

Recommendation Details

• Recommendation: 2.1.1
• Description: Ensure Safe Links for Office Applications is Enabled
• ELevel: E5
• Profile Level: L2
• CIS Control: 10.1
• CIS Description: Deploy and Maintain Anti-Malware Software
• Implementation Group 1: TRUE
• Implementation Group 2: TRUE
• Implementation Group 3: TRUE
• Automated: TRUE
• Connection: EXO

Test-SafeLinksOfficeApps.ps1

Tasks

Validate recommendation details

• [x] Confirm that the recommendation details are accurate and complete as per the CIS benchmark.

Validate test for a pass

• [ ] Confirm that the automated test results align with the manual audit steps outlined in the CIS benchmark.
  • Specific conditions to check:
  • Condition A: In the Microsoft 365 security center, Safe Links policy for Office applications is enabled and the following protection settings are set:
    • Office 365 Apps: On
    • Teams: On
    • Email: On
    • Click protection settings: On
    • Do not track when users click safe links: Off
  • Condition B: Using the Exchange Online PowerShell Module, Safe Links policies are retrieved, and the relevant policy shows Safe Links for Office applications is enabled.

Validate test for a fail

• [ ] Confirm that the failure conditions in the automated test are consistent with the manual audit results.
  • Specific conditions to check:
  • Condition A: In the Microsoft 365 security center, Safe Links policy for Office applications is not enabled or one or more of the required protection settings are not set correctly.
    • Office 365 Apps: Off
    • Teams: Off
    • Email: Off
    • Click protection settings: Off
    • Do not track when users click safe links: On
  • Condition B: Using the Exchange Online PowerShell Module, Safe Links policies are retrieved, and the relevant policy shows Safe Links for Office applications is not enabled.

Add notes and observations

• [ ] Compare the automated audit results with the manual audit steps and provide detailed observations.
  • Automated audit produced info consistent with the manual audit test results? (Yes/No)
  • Without disclosing any sensitive information, document any discrepancies between the actual output and the expected output.
  • Document any error messages, removing any sensitive information before submitting.
  • Identify the specific function, line, or section of the script that failed, if known.
  • Provide any additional context or observations that might help in troubleshooting.

If needed, the helpers folder in .\source\helpers contains a CSV to assist with locating the test definition.

[DrIOSX]

Base PowerShell audit:

 Get-SafeLinksPolicy | Format-Table Name

For each Name:

Get-SafeLinksPolicy -Identity "Policy Name"

#Verify the value for the following.
EnableSafeLinksForEmail: True
EnableSafeLinksForTeams: True
EnableSafeLinksForOffice: True
TrackClicks: True
AllowClickThrough: False
ScanUrls: True
EnableForInternalSenders: True
DeliverMessageAfterScan: True
DisableUrlRewrite: False