rules/findings/m365/microsoft_defender/system/ms-defender-zero-hour-auto-purge-for-teams-disabled.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Defender", "serviceName": "Microsoft 365", "displayName": "Ensure Zero-hour auto purge for Microsoft Teams is on", "description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.", "rationale": "ZAP is intended to protect users that have received zero-day malware messages or content that is weaponized after being delivered to users. It does this by continually monitoring spam and malware signatures taking automated retroactive action on messages that have already been delivered.", "impact": "As with any anti-malware or anti-phishing product, false positives may occur.", "remediation": { "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Microsoft Defender https://security.microsoft.com/ \r\n\t\t\t2. Click to expand System select Settings \u003e Email \u0026 collaboration \u003e Microsoft Teams protection. \r\n\t\t\t3. Set Zero-hour auto purge (ZAP) to On (Default)\r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams", "https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about?view=o365-worldwide#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "2.4.4", "profile": [ "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "o365_exo_teams_protection_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "ZapEnabled", "eq", "false" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "Identity": "Identity", "ZapEnabled": "ZAP Enabled", "MalwareQuarantineTag": "Malware Quarantine Tag" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "Identity": "Identity", "ZapEnabled": "ZAP Enabled", "MalwareQuarantineTag": "Malware Quarantine Tag" }, "expandObject": null }, "status": { "keyName": [ ], "message": "", "defaultMessage": "Ensure Zero-hour auto purge for Microsoft Teams is on" }, "properties": { "resourceName": "Identity", "resourceId": "ExchangeObjectId", "resourceType": "EXOTeamsProtectionPolicy" }, "onlyStatus": false } }, "idSuffix": "m365_exo_zero_hour_auto_purge_for_teams_disabled", "notes": [ ], "categories": [ ], "immutable_properties": [ ], "id": "microsoft365_2111" } |