CISA.MS.EXO.16.2: Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.


ID	`CISA.MS.EXO.16.2`
Severity	Medium
Suite	CISA SCuBA baselines
Product	Exchange Online
Related products	Defender
Feature	Alert policies
Security area	Logging and detection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, `MS.EXO.16.2` (SHOULD)
Framework controls	`cisa-scuba:MS.EXO.16.2` `nist-800-53-r5:SI-4(5)` System Monitoring \| System-generated Alerts
Reads from	Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed	`ATP_ENTERPRISE`

What this checks and how to fix it

Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.

Rationale: Suspicious or malicious events, if not resolved promptly, may have a greater impact to users and the agency. Sending alerts to a monitored email address or SIEM system helps ensure these suspicious or malicious events are acted upon in a timely manner to limit overall impact.

Remediation action:

Sign in to Microsoft 365 Defender.
Select Settings.
Select either:
- Microsoft Sentinel.
- Defender XDR, and under General, select Streaming API.
Ensure a SIEM integration is configured for your organization.

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

CISA.MS.EXO.16.2: Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.

What this checks and how to fix it

Remediation action:

Related links