internal/orca/check-ORCA121.ps1
|
# Generated by .\build\orca\Update-OrcaTests.ps1 using module ".\orcaClass.psm1" [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingEmptyCatchBlock', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSPossibleIncorrectComparisonWithNull', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingCmdletAliases', '')] param() class ORCA121 : ORCACheck { <# CONSTRUCTOR with Check Header Data #> ORCA121() { $this.Control=121 $this.Area="Zero Hour Autopurge" $this.Name="Supported filter policy action" $this.PassText="Supported filter policy action used" $this.FailRecommendation="Change filter policy action to support Zero Hour Auto Purge" $this.Importance="Zero Hour Autopurge can assist removing false-negatives post detection from mailboxes. It requires a supported action in the spam filter policy." $this.ExpandResults=$True $this.CheckType=[CheckType]::ObjectPropertyValue $this.ChiValue=[ORCACHI]::VeryHigh $this.ObjectType="Policy" $this.ItemName="Setting" $this.DataType="Action" $this.Links= @{ "Microsoft 365 Defender Portal - Anti-spam settings"="https://security.microsoft.com/antispam" "Zero-hour auto purge - protection against spam and malware"="https://aka.ms/orca-zha-docs-2" } } <# RESULTS #> GetResults($Config) { #$CountOfPolicies = ($Config["HostedContentFilterPolicy"]).Count $CountOfPolicies = ($global:HostedContentPolicyStatus| Where-Object {$_.IsEnabled -eq $True}).Count ForEach($Policy in $Config["HostedContentFilterPolicy"]) { $IsPolicyDisabled = !$Config["PolicyStates"][$Policy.Guid.ToString()].Applies $SpamAction = $($Policy.SpamAction) $PhishSpamAction =$($Policy.PhishSpamAction) $IsBuiltIn = $false $policyname = $Config["PolicyStates"][$Policy.Guid.ToString()].Name # Check requirement of Spam ZAP - MoveToJmf, redirect, delete, quarantine # Check objects $ConfigObject = [ORCACheckConfig]::new() $ConfigObject.Object=$policyname $ConfigObject.ConfigItem="SpamAction" $ConfigObject.ConfigReadonly=$Policy.IsPreset $ConfigObject.ConfigDisabled = $Config["PolicyStates"][$Policy.Guid.ToString()].Disabled $ConfigObject.ConfigWontApply = !$Config["PolicyStates"][$Policy.Guid.ToString()].Applies $ConfigObject.ConfigPolicyGuid=$Policy.Guid.ToString() If($SpamAction -eq "MoveToJmf" -or $SpamAction -eq "Redirect" -or $SpamAction -eq "Delete" -or $SpamAction -eq "Quarantine") { $ConfigObject.ConfigData=$SpamAction $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Pass") } else { $ConfigObject.ConfigData=$SpamAction $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail") } $this.AddConfig($ConfigObject) # Check requirement of Phish ZAP - MoveToJmf, redirect, delete, quarantine # Check objects $ConfigObject = [ORCACheckConfig]::new() $ConfigObject.Object=$policyname $ConfigObject.ConfigItem="PhishSpamAction" $ConfigObject.ConfigReadonly=$Policy.IsPreset $ConfigObject.ConfigDisabled=$IsPolicyDisabled $ConfigObject.ConfigPolicyGuid=$Policy.Guid.ToString() If($PhishSpamAction -eq "MoveToJmf" -or $PhishSpamAction -eq "Redirect" -or $PhishSpamAction -eq "Delete" -or $PhishSpamAction -eq "Quarantine") { $ConfigObject.ConfigData=$PhishSpamAction $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Pass") } else { $ConfigObject.ConfigData=$PhishSpamAction $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail") } $this.AddConfig($ConfigObject) } } } |