Exchange forwarding rule configured

Supported Cortex XSOAR versions: 6.10.0 and later.

This playbook addresses the following alerts:

Playbook Stages:

Triage:

The playbook retrieves the caller's IP, the forwarding email address, and the domain.

Early Containment:

The playbook checks if the IP or domain of the forwarding email address is malicious. If so, it suggests blocking the IP using PAN-OS while continuing the investigation in parallel.

Investigation:

The playbook checks for suspicious behaviors, including whether an Exchange admin created the rule outside of working hours, from unusual geolocation, or if the user who created the rule has a high-risk score. It then aggregates all evidence collected during the investigation.

Containment:

Soft Response Actions: If at least two suspicious pieces of evidence are identified, the playbook will execute soft response actions. These actions include signing the user out and disabling the forwarding rule configured in the user's account mailbox.
Hard Response Actions: If more than two suspicious pieces of evidence are identified, the playbook escalates to hard response actions. These actions include disabling the user account upon analyst decision and removing the forwarding rule from the user's account mailbox.

Requirements:

For any response action, you need the following integrations:

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

There are no inputs for this playbook.

There are no outputs for this playbook.

Exchange forwarding rule configured