Checks/check-ORCA233.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
<#
 
233 - Check EF is turned on where MX not set to ATP
 
#>


using module "..\ORCA.psm1"

class ORCA233 : ORCACheck
{
    <#
     
        CONSTRUCTOR with Check Header Data
     
    #>


    ORCA233()
    {
        $this.Control=233
        $this.Area="Connectors"
        $this.Name="Domains"
        $this.PassText="Domains are pointed directly at EOP or enhanced filtering is used"
        $this.FailRecommendation="Send mail directly to EOP or configure enhanced filtering"
        $this.Importance="Exchange Online Protection (EOP) and Advanced Threat Protection (ATP) works best when the mail exchange (MX) record is pointed directly at the service. <p>In the event another third-party service is being used, a very important signal (the senders IP address) is obfuscated and hidden from EOP & ATP, generating a larger quantity of false positives and false negatives. By configuring Enhanced Filtering with the IP addresses of these services the true senders IP address can be discovered, reducing the false-positive and false-negative impact.</p>"
        $this.ExpandResults=$True
        $this.CheckType=[CheckType]::ObjectPropertyValue
        $this.ObjectType="Domain"
        $this.ItemName="Points to Service"
        $this.DataType="Enhanced Filtering"
        $this.Links= @{
            "Security & Compliance Center - Enhanced Filtering"="https://protection.office.com/skiplisting"
            "Enhanced Filtering for Connectors"="https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors"
        }
    }

    <#
     
        RESULTS
     
    #>


    GetResults($Config)
    {

        $Connectors = @()

        # Analyze connectors
        ForEach($Connector in $($Config["InboundConnector"] | Where-Object {$_.Enabled}))
        {
            # Set regex options for later match
            $options = [Text.RegularExpressions.RegexOptions]::IgnoreCase

            ForEach($senderdomain in $Connector.SenderDomains)
            {
                # Perform match on sender domain
                $match = [regex]::Match($senderdomain,"^smtp:\*;(\d*)$",$options)

                if($match.success)
                {

                    # Positive match
                    $Connectors += New-Object -TypeName PSObject -Property @{
                        Identity=$Connector.Identity
                        Priority=$($match.Groups[1].Value)
                        TlsSenderCertificateName=$Connector.TlsSenderCertificateName
                        EFTestMode=$Connector.EFTestMode
                        EFSkipLastIP=$Connector.EFSkipLastIP
                        EFSkipIPs=$Connector.EFSkipIPs
                        EFSkipMailGateway=$Connector.EFSkipMailGateway
                        EFUsers=$Connector.EFUsers
                    }
                }
            }

        }

        $EFDisabledConnectors = @($Connectors | Where-Object {($_.EFSkipIPs.Count -eq 0 -and $_.EFSkipLastIP -eq $False) -or $_.EFTestMode -eq $True -or $_.EFUsers.Count -gt 0})

        If($EFDisabledConnectors.Count -gt 0 -or $Connectors.Count -eq 0)
        {
            $EnhancedFiltering = $False
        }
        else
        {
            $EnhancedFiltering = $True
        }

        ForEach($Domain in $Config["AcceptedDomains"]) 
        {

            # Get the MX record report for this domain

            $MXRecords = @($Config["MXReports"] | Where-Object {$_.Domain -eq $($Domain.DomainName)})

            # Construct config object

            $ConfigObject = [ORCACheckConfig]::new()

            $ConfigObject.Object=$($Domain.Name)

            If($MXRecords.PointsToService -Contains $False)
            {
                $PointsToService = $False
            }
            else
            {
                $PointsToService = $True
            }

            If($PointsToService)
            {

                $ConfigObject.ConfigItem="Yes"
                $ConfigObject.ConfigData="Not Required"
                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Pass")

            }
            else
            {
                $ConfigObject.ConfigItem="No"

                If($EnhancedFiltering)
                {
                    $ConfigObject.ConfigData="Configured"
                    $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Pass")
                }
                else
                {
                    $ConfigObject.ConfigData="Not Configured"
                    $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")
                    $ConfigObject.InfoText = "This domain is not pointed to EOP and all default inbound connectors are not configured for skip listing. Check the enhanced filtering segment for more information."
                }
            }

            $this.AddConfig($ConfigObject)

        }

    }

}