Confirming XDR Setup

jrodch_101

I'm setting up the O365 XDR sensor for the first time. The status shows as active.

My concern is with the auditing setup. I enabled auditing via Exchange Online Powershell. But the KB has a Powershelll ****** that isn't working for me.

Is there any way I can see if the sensor is working?

Andrei_S Enterprise

Hello @jrodch_101 ,

To test the O365 XDR sensor and see if it is properly configured you can generate these alerts :

• Audit logs have been disabled.
• User reuploaded word document, now with macros.
• User uploaded executable/macro double-extension files (e.g. "doc.exe", "txt.dll", "xls.ps1" etc. or "docm", "xlsm", "pptm" etc. etc.)

I am also reattaching the KB article in case you did not use this one:

https://www.bitdefender.com/business/support/en/77209-452343-the-o365-sensor.html#UUID-743c943f-348d-167d-179b-9f3585635e11_section-idm4556731626502434006417021799

If some of the PowerShell commands did not work we need to investigate through support what is the reason for this. You can open a case with us through

https://www.bitdefender.com/en-us/support/contact-us?last_page=BusinessCategory

Kind Regards,

Andrei

jrodch_101

https://community.bitdefender.com/en/discussion/comment/347440#Comment_347440

Thanks for the info. This still isn't working for me. I've tried to submit a support ticket several times, but the form keeps telling me to try again later. Please advise.

Andrei_S Enterprise

Hello @jrodch_101 ,

Please try to clear browser cache and cookies and try again but also you can use the alternative contact methods such as chat and phone: https://www.bitdefender.com/business/support/en/71263-85158-contact.html

If you are still experiencing issues, share with me in private your email address or phone number to be contacted and I will reach out to my colleagues and ask the to contact you directly.

Kind Regards,

Andrei