Confirming XDR Setup
I'm setting up the O365 XDR sensor for the first time. The status shows as active.
My concern is with the auditing setup. I enabled auditing via Exchange Online Powershell. But the KB has a Powershelll ****** that isn't working for me.
Is there any way I can see if the sensor is working?
Comments
-
Hello @jrodch_101 ,
To test the O365 XDR sensor and see if it is properly configured you can generate these alerts :
- Audit logs have been disabled.
- User reuploaded word document, now with macros.
- User uploaded executable/macro double-extension files (e.g. "doc.exe", "txt.dll", "xls.ps1" etc. or "docm", "xlsm", "pptm" etc. etc.)
I am also reattaching the KB article in case you did not use this one:
If some of the PowerShell commands did not work we need to investigate through support what is the reason for this. You can open a case with us through
Kind Regards,
Andrei
1 -
Thanks for the info. This still isn't working for me. I've tried to submit a support ticket several times, but the form keeps telling me to try again later. Please advise.
0 -
Hello @jrodch_101 ,
Please try to clear browser cache and cookies and try again but also you can use the alternative contact methods such as chat and phone:
If you are still experiencing issues, share with me in private your email address or phone number to be contacted and I will reach out to my colleagues and ask the to contact you directly.
Kind Regards,
Andrei
0
