rules/findings/m365/microsoft_defender/atp/ms-defender-atp-safe-attachments-for-sharepoint-onedrive-and-teams-disabled.json
|
{
"provider": "Microsoft365", "serviceType": "Defender", "serviceName": "Microsoft 365", "displayName": "Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled", "description": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.", "rationale": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protect organizations from inadvertently sharing malicious files. When a malicious file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization\u0027s security team.", "impact": "Impact associated with Safe Attachments is minimal, and equivalent to impact associated with anti-virus scanners in an environment.", "remediation": { "text": "", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "2.1.5", "profile": [ "E5 Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "o365_exo_atp_policy", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "EnableATPForSPOTeamsODB", "eq", "false" ], [ "EnableSafeDocs", "eq", "false" ], [ "AllowSafeDocsOpen", "eq", "true" ] ], "operator": "or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "identity": "Identity", "enableATPForSPOTeamsODB": "ATP For Office 365", "enableSafeDocs": "SafeDocs Enabled", "allowSafeDocsOpen": "Enable SafeDocs Open" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "identity": "Identity", "enableATPForSPOTeamsODB": "ATP For Office 365", "enableSafeDocs": "SafeDocs Enabled", "allowSafeDocsOpen": "Enable SafeDocs Open" }, "expandObject": null }, "status": { "keyName": [], "message": "Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled", "defaultMessage": null }, "properties": { "resourceName": "Identity", "resourceId": "ExchangeObjectId", "resourceType": "EXOATPPolicy" }, "onlyStatus": false } }, "idSuffix": "m365_exo_safe_attachment_policy_office_apps_disabled", "notes": [], "categories": [], "immutableProperties": [], "id": "microsoft365_2102" } |