Exchange
You can integrate your EWS environment with the Incident Responder product by following the steps below.
First, you must have or create a Microsoft user identity with either impersonation or delegation permission.
The user must have exchange admin permissions to configure these options.
Please refer to this document for information on how to create a service/admin user.
The impersonation option is recommended for setting up email server integration.
Impersonation
Impersonation gives one service account access to every mailbox in a database. This enables quick and easy investigation and response to an incident.
Restrictions may also be designated for the impersonation account, depending on the policies of the organization.
The following command can be used in the Exchange Management Shell to grant the impersonation privilege to a service account. This example assigns the service account service@company.com full access permission to all user mailboxes in the company.com organization.
Delegation
The delegation privilege requires that permissions be added individually to each mailbox. The platform can access the mailboxes within the Exchange designated by the organization.
Restrictions may also be designated for the account, depending on the policies of the organization.
The following command can be used in the Exchange Management Shell to grant delegation privilege to a service account. This example assigns the service account user service@company.com full access permission to the specified ‘TargetUserName’ user mailbox.
Test the Integration
To make sure that the integration is working, you can test it on the platform. Go to Incident Responder > Mail Configurations on the left sidebar menu of the dashboard and then click + NEW and choose the mail provider - in this case, Exchange EWS. Complete the following fields in the configuration table:
The integration details are:
Name | Name of the configuration |
Service URL | Exchange URL information |
Exchange Version | Exchange version information |
Account Type | Account type of the service user |
Username | Username of the service user |
Password | Password of the service user |
Test Email Address | An active email address to be used for testing purposes |
X-Anchor Mail Box Header | Check this box if the platform needs to use the X-Anchor MailBox header in connections to the Exchange server. |
Target Groups | Selection of the users to be subjects of investigation All Groups: All user inboxes Specific User Groups: Selected group of user inboxes |
Test Connection | Perform a test of the configuration |
The new configuration will now appear in the list of mail configurations if the test was successful.
If an X appears, it indicates there was a problem and the email server integration failed; please review the instructions.
Throttling Policy Configuration
What is Throttling Policy?
Throttling policy is a control mechanism designed to preserve server reliability and functionality by limiting the resources consumed by a single user or application.
The Microsoft Exchange throttling policy is a default setting that restricts users on various client access protocols, such as MAPI, Activesync, OWA, POP3, etc., intended to prevent a potential crash or denial of service (DoS) via repeated requests.
The default throttling policy is always active if a user has not specified an alternate throttling policy.
A successful integration between Exchange and the Incident Responder will lead to hundreds of connections on the Exchange server when an investigation begins.
The investigation may be obstructed by the throttling policy. Therefore, the default throttling policy rights of the service user defined in the Incident Responder product should be expanded to avoid this problem.
Choose a Throttling Policy
You can use the command below in Exchange Management to view all of the available throttling policies.
Add a New Throttling Policy
Open the Exchange Management Shell and use the command below to create a new throttling policy.
Configure Authorizations for the Throttling Policy
Once you have added a new throttling policy, please enter the following command to set the permissions of the new policy.
Assign Throttling Policy to a Service
User Use the command below to assign a throttling policy to a specific user. Replace “service@company.com” with the service user you designated in the Incident Responder.
Last updated