Enhance the AMSI Request Body Scanning analysis #2490
+108
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Member
|
looks good, is it worth our time to add in pester testing covering the problem that this new code does address? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
Enhances the AMSI Request Body Scanning analysis to provide more detailed and actionable information about the configuration state.
When AMSI Request Body Scanning is enabled for specific protocols (rather than globally via
EnabledAll), the output now lists which protocols are configured:I've also added yellow warning indicator when AMSI Request Body Scanning is not enabled.
I've also fixed the analyzer logic of the AMSI body scanning feature. The logic in Exchange Server is the following:
EnabledAll == truemeans that AMSI body scanning is enabled for any protocol. Starting with the Aug25SU,EnabledAll == trueis the default without explicitly setting the value via SO.If you're running the Aug25Su and you want to disable AMSI body scanning for all protocols except selected protocols, the logic is the following:
EnabledAll == falsevia SOEnabledEcp == true,EnabledOwa == true)Validation:
Lab