SecurityBreach - Revision history

Aleks: /* O365 Mail security */

2024-05-20T15:32:18Z

O365 Mail security

← Older revision		Revision as of 16:32, 20 May 2024
Line 20:		Line 20:

	Connect to the compliance tool with the following cmdlet - it connects in the same way as with exchange online:		Connect to the compliance tool with the following cmdlet - it connects in the same way as with exchange online:
	*Connect-IPPSSession -UserPrincipalName <username@domain.com>		<syntaxhighlight lang="powershell">
			Connect-IPPSSession -UserPrincipalName <username@domain.com>
			</syntaxhighlight>
	----		----
	Then you can create a compliance search to identify the emails you need eg:		Then you can create a compliance search to identify the emails you need eg:
	*New-ComplianceSearch -Name "<name for search>" -ContentMatchQuery "<words to match in email>" -ExchangeLocation All		<syntaxhighlight lang="powershell">
			New-ComplianceSearch -Name "<name for search>" -ContentMatchQuery "<words to match in email>" -ExchangeLocation All
			</syntaxhighlight>
	The exchange location can be specified to be the domain or a security group or a specific mailbox, there are options.		The exchange location can be specified to be the domain or a security group or a specific mailbox, there are options.
	----		----
	You will then need to start the compliance search:		You will then need to start the compliance search:
	*Start-ComplianceSearch <name of compliancesearch>		<syntaxhighlight lang="powershell">
			Start-ComplianceSearch <name of compliancesearch>
			</syntaxhighlight>

	----		----
	You can check the progress by using the command:		You can check the progress by using the command:
	*Get-ComplianceSearch		<syntaxhighlight lang="powershell">
			Get-ComplianceSearch
			</syntaxhighlight>

	----		----
	To see the details of the search you can use the following (output to file for easier reading):		To see the details of the search you can use the following (output to file for easier reading):
	*Get-ComplianceSearch -Identity <compliance search name> \| fl \| out-file C:\temp\searchresults.txt		<syntaxhighlight lang="powershell">
			Get-ComplianceSearch -Identity <compliance search name> \| fl \| out-file C:\temp\searchresults.txt
			</syntaxhighlight>
	----		----
	To complete the deletion of the emails use the following command:		To complete the deletion of the emails use the following command:
	*New-ComplianceSearchAction -SearchName "<search name>" -Purge -PurgeType HardDelete		<syntaxhighlight lang="powershell">
			New-ComplianceSearchAction -SearchName "<search name>" -Purge -PurgeType HardDelete
			</syntaxhighlight>

Aleks: 4 revisions imported

2023-11-15T20:32:32Z

4 revisions imported

← Older revision	Revision as of 21:32, 15 November 2023
(No difference)

piszczynski>Aleks at 09:40, 21 June 2022

2022-06-21T09:40:20Z

← Older revision		Revision as of 10:40, 21 June 2022
Line 1:		Line 1:


	== Email Security breach ==		== Email Security breach ==
Line 9:		Line 10:
	Then you will need to check through logs to find out the logins of the account and any other servers that could be affected.		Then you will need to check through logs to find out the logins of the account and any other servers that could be affected.

			Follow the following guide:
			https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide

	== O365 Mail security ==		== O365 Mail security ==

piszczynski>Aleks: /* O365 Mail security */

2022-06-17T14:16:54Z

O365 Mail security

piszczynski>Aleks: /* O365 Mail security */

2022-06-17T14:15:41Z

O365 Mail security

← Older revision		Revision as of 15:15, 17 June 2022
Line 29:		Line 29:
	You can check the progress by using the command:		You can check the progress by using the command:
	*Get-ComplianceSearch		*Get-ComplianceSearch

			To see the details of the search you can use the following (output to file for easier reading):
			*Get-ComplianceSearch -Identity <compliance search name> \| fl \| out-file C:\temp\searchresults.txt

			To complete the deletion of the emails use the following command:
			*New-ComplianceSearchAction -SearchName "<search name>" -Purge -PurgeType HardDelete

piszczynski>Aleks: Created page with " == Email Security breach == For any account compromised or security breach must do the following: disable account in local AD and Azure AD if hybrid identify the device or..."

2022-06-17T14:07:41Z

Created page with " == Email Security breach == For any account compromised or security breach must do the following: *disable account in local AD and Azure AD if hybrid *identify the device or..."

New page

== Email Security breach ==

For any account compromised or security breach must do the following:
*disable account in local AD and Azure AD if hybrid
*identify the device or server affected and remove from any network it is attached to
*start any AV scans with tools available

Then you will need to check through logs to find out the logins of the account and any other servers that could be affected.

== O365 Mail security ==

If a malicious email is sent and you need to clear from any or all mailboxes in O365 exchange you can use the compliance tool

The compliance tool uses the exchangeonline powershell module

Connect to the compliance tool with the following cmdlet - it connects in the same way as with exchange online:
*Connect-IPPSSession -UserPrincipalName <username@domain.com>

Then you can create a compliance search to identify the emails you need eg:
*New-ComplianceSearch -Name "<name for search>" -ContentMatchQuery "<words to match in email>" -ExchangeLocation All

The exchange location can be specified to be the domain or a security group or a specific mailbox, there are options.

You will then need to start the compliance search:
*Start-ComplianceSearch <name of compliancesearch>

You can check the progress by using the command:
*Get-ComplianceSearch

← Older revision		Revision as of 15:16, 17 June 2022
Line 18:		Line 18:
	Connect to the compliance tool with the following cmdlet - it connects in the same way as with exchange online:		Connect to the compliance tool with the following cmdlet - it connects in the same way as with exchange online:
	*Connect-IPPSSession -UserPrincipalName <username@domain.com>		*Connect-IPPSSession -UserPrincipalName <username@domain.com>
			----
	Then you can create a compliance search to identify the emails you need eg:		Then you can create a compliance search to identify the emails you need eg:
	*New-ComplianceSearch -Name "<name for search>" -ContentMatchQuery "<words to match in email>" -ExchangeLocation All		*New-ComplianceSearch -Name "<name for search>" -ContentMatchQuery "<words to match in email>" -ExchangeLocation All

	The exchange location can be specified to be the domain or a security group or a specific mailbox, there are options.		The exchange location can be specified to be the domain or a security group or a specific mailbox, there are options.
			----
	You will then need to start the compliance search:		You will then need to start the compliance search:
	*Start-ComplianceSearch <name of compliancesearch>		*Start-ComplianceSearch <name of compliancesearch>
			----
	You can check the progress by using the command:		You can check the progress by using the command:
	*Get-ComplianceSearch		*Get-ComplianceSearch
			----
	To see the details of the search you can use the following (output to file for easier reading):		To see the details of the search you can use the following (output to file for easier reading):
	*Get-ComplianceSearch -Identity <compliance search name> \| fl \| out-file C:\temp\searchresults.txt		*Get-ComplianceSearch -Identity <compliance search name> \| fl \| out-file C:\temp\searchresults.txt
			----
	To complete the deletion of the emails use the following command:		To complete the deletion of the emails use the following command:
	*New-ComplianceSearchAction -SearchName "<search name>" -Purge -PurgeType HardDelete		*New-ComplianceSearchAction -SearchName "<search name>" -Purge -PurgeType HardDelete

SecurityBreach - Revision history

Aleks: /* O365 Mail security */

Aleks: 4 revisions imported

piszczynski>Aleks at 09:40, 21 June 2022

piszczynski>Aleks: /* O365 Mail security */

piszczynski>Aleks: /* O365 Mail security */

piszczynski>Aleks: Created page with " == Email Security breach == For any account compromised or security breach must do the following: *disable account in local AD and Azure AD if hybrid *identify the device or..."

piszczynski>Aleks: Created page with " == Email Security breach == For any account compromised or security breach must do the following: disable account in local AD and Azure AD if hybrid identify the device or..."