Supported filter policy action used
ORCA.121MediumDefenderZero-hour auto purge
Part of ORCA · Defender · Zero-hour auto purge · All checks
Invoke-Maester -TestId ORCA.121Overview
Section titled “Overview”Zero Hour Autopurge can assist removing false-negatives post detection from mailboxes. It requires a supported action in the spam filter policy.
Remediation action
Section titled “Remediation action”Change filter policy action to support Zero Hour Auto Purge.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Anti-spam settings
- Zero-hour auto purge - protection against spam and malware
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.121 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Zero-hour auto purge |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| PowerShell test | Test-ORCA121 |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.121.ps1 - Documentation:
tests/orca/Test.ORCA.121.md