Exchange (EWS)
Last updated
Was this helpful?
Last updated
Was this helpful?
You can integrate your EWS environment with the Incident Responder product by following the steps below.
First, you must have or create a Microsoft user identity with either impersonation or delegation permission.
The user must have exchange admin permissions to configure these options.
Please refer to this for information on how to create a service/admin user.
The impersonation option is recommended for setting up email server integration.
Impersonation gives one service account access to every mailbox in a database. This enables quick and easy investigation and response to an incident.
Restrictions may also be designated for the impersonation account, depending on the policies of the organization.
The following command can be used in the Exchange Management Shell to grant the impersonation privilege to a service account. This example assigns the service account service@company.com full access permission to all user mailboxes in the company.com organization.
The delegation privilege requires that permissions be added individually to each mailbox. The platform can access the mailboxes within the Exchange designated by the organization.
Restrictions may also be designated for the account, depending on the policies of the organization.
The following command can be used in the Exchange Management Shell to grant delegation privilege to a service account. This example assigns the service account user service@company.com full access permission to the specified ‘TargetUserName’ user mailbox.
To make sure that the integration is working, you can test it on the platform. Go to Incident Responder > Mail Configurations on the left sidebar menu of the dashboard and then click + NEW and choose the mail provider - in this case, Exchange EWS. Complete the following fields in the configuration table:
The integration details are:
Name
Name of the configuration
Service URL
Exchange URL information
Exchange Version
Exchange version information
Account Type
Account type of the service user
Username
Username of the service user
Password
Password of the service user
Test Email Address
An active email address to be used for testing purposes
X-Anchor Mail Box Header
Check this box if the platform needs to use the X-Anchor MailBox header in connections to the Exchange server.
Target Groups
Selection of the users to be subjects of investigation
All Groups: All user inboxes
Specific User Groups: Selected group of user inboxes
Test Connection
Perform a test of the configuration
The new configuration will now appear in the list of mail configurations if the test was successful.
If an X appears, it indicates there was a problem and the email server integration failed; please review the instructions.
Throttling policy is a control mechanism designed to preserve server reliability and functionality by limiting the resources consumed by a single user or application.
The Microsoft Exchange throttling policy is a default setting that restricts users on various client access protocols, such as MAPI, Activesync, OWA, POP3, etc., intended to prevent a potential crash or denial of service (DoS) via repeated requests.
A successful integration between Exchange and the Incident Responder will lead to hundreds of connections on the Exchange server when an investigation begins.
The investigation may be obstructed by the throttling policy. Therefore, the default throttling policy rights of the service user defined in the Incident Responder product should be expanded to avoid this problem.
You can use the command below in Exchange Management to view all of the available throttling policies.
Open the Exchange Management Shell and use the command below to create a new throttling policy.
Once you have added a new throttling policy, please enter the following command to set the permissions of the new policy.
User Use the command below to assign a throttling policy to a specific user. Replace “service@company.com” with the service user you designated in the Incident Responder.