Exchange (EWS)

You can integrate your EWS environment with the Incident Responder product by following the steps below.

First, you must have or create a Microsoft user identity with either impersonation or delegation permission.

The user must have exchange admin permissions to configure these options.

Please refer to this document for information on how to create a service/admin user.

The impersonation option is recommended for setting up email server integration.

Impersonation

Impersonation gives one service account access to every mailbox in a database. This enables quick and easy investigation and response to an incident.

Restrictions may also be designated for the impersonation account, depending on the policies of the organization.

The following command can be used in the Exchange Management Shell to grant the impersonation privilege to a service account. This example assigns the service account [email protected] full access permission to all user mailboxes in the company.com organization.

[PS] C:\Windows\system32> Get-Mailbox -ResultSize unlimited -Filter "(RecipientTypeDetails -eq 'UserMailbox') -and (Alias -ne 'Admin')" | Add-MailboxPermission -User [email protected] -AccessRights FullAccess -InheritanceType All

Delegation

The delegation privilege requires that permissions be added individually to each mailbox. The platform can access the mailboxes within the Exchange designated by the organization.

Restrictions may also be designated for the account, depending on the policies of the organization.

The following command can be used in the Exchange Management Shell to grant delegation privilege to a service account. This example assigns the service account user [email protected] full access permission to the specified ‘TargetUserName’ user mailbox.

[PS] C:\Windows\system32> Add-MailboxPermission -Identity "TargetUserName" -User "[email protected]" -AccessRights FullAccess 

Test the Integration

To make sure that the integration is working, you can test it on the platform. Go to Incident Responder > Mail Configurations on the left sidebar menu of the dashboard and then click + NEW and choose the mail provider - in this case, Exchange EWS. Complete the following fields in the configuration table:

The integration details are:

Name	Name of the configuration
Service URL	Exchange URL information
Exchange Version	Exchange version information
Account Type	Account type of the service user
Username	Username of the service user
Password	Password of the service user
Test Email Address	An active email address to be used for testing purposes
X-Anchor Mail Box Header	Check this box if the platform needs to use the X-Anchor MailBox header in connections to the Exchange server.
Target Groups	Selection of the users to be subjects of investigation All Groups: All user inboxes Specific User Groups: Selected group of user inboxes
Test Connection	Perform a test of the configuration

The new configuration will now appear in the list of mail configurations if the test was successful.

If an X appears, it indicates there was a problem and the email server integration failed; please review the instructions.

Throttling Policy Configuration

What is Throttling Policy?

Throttling policy is a control mechanism designed to preserve server reliability and functionality by limiting the resources consumed by a single user or application.

The Microsoft Exchange throttling policy is a default setting that restricts users on various client access protocols, such as MAPI, Activesync, OWA, POP3, etc., intended to prevent a potential crash or denial of service (DoS) via repeated requests.

The default throttling policy is always active if a user has not specified an alternate throttling policy.

A successful integration between Exchange and the Incident Responder will lead to hundreds of connections on the Exchange server when an investigation begins.

The investigation may be obstructed by the throttling policy. Therefore, the default throttling policy rights of the service user defined in the Incident Responder product should be expanded to avoid this problem.

Choose a Throttling Policy

You can use the command below in Exchange Management to view all of the available throttling policies.

Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true}

Add a New Throttling Policy

Open the Exchange Management Shell and use the command below to create a new throttling policy.

New-ThrottlingPolicy KeepnetUnlimitedPolicyName

Configure Authorizations for the Throttling Policy

Once you have added a new throttling policy, please enter the following command to set the permissions of the new policy.

Set-ThrottlingPolicy KeepnetUnlimitedPolicyName -RCAMaxConcurrency Unlimited -Exchange EWSMaxConcurrency Unlimited -Exchange EWSMaxSubscriptions Unlimited -CPAMaxConcurrency Unlimited -Exchange EWSCutoffBalance Unlimited -Exchange EWSMaxBurst Unlimited -Exchange EWSRechargeRate Unlimited -Exchange EWSFindCountLimit Unlimited

Assign Throttling Policy to a Service

User Use the command below to assign a throttling policy to a specific user. Replace “[email protected]” with the service user you designated in the Incident Responder.

Set-Mailbox “[email protected]" -ThrottlingPolicy KeepnetUnlimitedPolicyName