this is susan bradley for cso online security is always a balance a balance between needs and
budgets between cost and licensing fees microsoft recently is becoming the de facto leader in
security both in terms of solutions and in terms of revenues generated but that leadership is also
building a divide between the haves and have-nots and sometimes it's a struggle to see how you can
best use your resources many of microsoft's security tools are behind an e5 license and
it's up to you to figure out what's the most efficient way to get that resource that you need
sometimes it's an e5 license itself sometimes it's an add-on that gives you the benefit
one of the recent changes that has come out is advanced auditing in microsoft 365.
the tools are impressive first it allows the firm to retain audit logs in all exchange
sharepoint and sewer active directory records for one year with the ability
to increase that audit log retention for 10 years with an additional license add-on
this 10-year retention will allow firms to perform investigations and respond to regulatory legal
and internal obligations other audit logs will be retained for 90 days as a default
another added item in the audit logs is a auditing called mail items accessed
with mail items access you can narrow down what attackers actually accessed in your log in your
exchange environment so for example you go from where you just knew that an intruder
came into your environment versus knowing exactly what the intruder
looked at it allows you to narrow the scope and narrow the focus of the intrusion
now demonstrate this first off i recommend that you highly bookmark this website that lists all
the different microsoft administrators sites and portals i find it extremely helpful to get
exactly to the portal that i need in this case we want to go to a microsoft 365 compliance center
and we want to scroll down to the solutions catalog site and
we specifically want to find the auditing section and we're going to open that solution
and what we're looking for is the mail access items and sometimes it helps to
search for it rather than try to scroll down so we're going to find the mail access items
and we're going to use the keyword access
and you can see there's access file access mailbox item and that's our specific
one that we're wanting to search for
mail items access replaces the message bind event tracking log that we used to search for
so here's our search result and it as you can see it indicates the internet message id
so you can trace back exactly what the attacker had access inside your environment
it lets you know who the owner of that information was
as well as the ip address and the client that they use to open it up
if you've been tracking the various tools and resources that have come out regarding
the solarwinds attacks you will notice that many of these scripts try to look for the mail
items accessed and report on it for example we're looking now at the cisa release sparrow
script where they look for intrusions inside the environment to see if if the solar winds attacks
impacted your environment inside here you can see that they actually refer to the mail items access
section and it indicates that yes indeed you need to have an e5 or a g5 license so once again
you need to know exactly what licensing you have what rights do you have to certain auditing events
and if you don't have those events do you have any alternatives to help you in your environment
back in march of 2020 tony redman wrote a blog post on how to capture crucial office
365 audit data and how it requires these e5 licenses and he indicates how crucial it is
and the retention logging that you need as well now he indicates that he doesn't have
any issue with microsoft classifying the mail items access event as crucial in demanding a
premium for its capture he indicates that only some tenants will be interested in these events
and they probably have an e5 license already now i'm of the opposite opinion
microsoft has said time and again that we need to approach everything from assume breach standpoint
they themselves assume breach this is one audit log event that i think should be
not gated behind an e5 license i think it should be down where all of us have the ability
to turn this on and to track this event it's a highly highly important event
to know about and it also helps us narrow down the focus of our investigations
you'll want to review your needs for these advanced auditing techniques and determine if
your organization needs the ability to identify exactly what the attackers were able to access
your environment you may need to add additional licenses in order to narrow your investigations
again look at your environment see if you need this information
determine if you need a full e5 across the board or if you need to narrow it down that
e5 and just apply it to certain people in your organization you can mix and match licenses
this is one of those techniques and one of those tools that if you
assume breach in your environment i think this is one of those
tools that you need to have in your arsenal again i wish microsoft
allowed that everyone had would have this and it's not just getting behind an e5 license
as always remember go out to the youtube channel the idg check tech talk there's lots more videos
and ideas out there for how you can keep yourself secure and safe
until next time this is susan bradley for cso online you