Microsoft Exchange Online integration
Summarize
Summary of Microsoft Exchange Online integration
The Microsoft Exchange Online integration with the ServiceNow AI Platform® Security Incident Response (SIR) product enables Security Operations Center (SOC) analysts to search, identify, and remediate phishing emails within their corporate email environment. Analysts can perform targeted searches using criteria such as subject lines, sender, and recipient addresses. Following the search, suspicious emails can be deleted directly from Microsoft Exchange Online, with an optional approval workflow to control deletions.
Show less
This integration supports a comprehensive phishing response process, allowing analysts to track phishing campaigns by finding related emails received by other users, helping to quickly identify potential victims and mitigate risks.
Key Features
- Configurable search criteria based on sender, recipient, and subject fields to detect phishing threats.
- Email notifications alert analysts when large or lengthy searches complete, including the count of matched emails.
- Status indicators show if recipients have read or deleted suspicious messages.
- Optional approval workflows ensure deletion requests are authorized before emails are permanently removed.
- Comprehensive audit trails record delete requests and outcomes within security incident work notes.
- Security tags track and visually indicate the progress and results of email search and delete workflows.
Supported Environments
This integration supports Microsoft Exchange Online services as part of Microsoft Office 365 (Exchange 2016 version). It does not support hosted Microsoft Exchange environments.
Prerequisites and Setup
- Install the com.snc.sidep plugin to support Security Incident Response and its dependencies.
- Sequentially install and activate required Security Operations applications from the ServiceNow Store, including Security Integration Framework, Security Support Common, Security Support Orchestration, and Security Incident Response.
- Set up a Microsoft Azure account with access to the Microsoft Exchange Online tenant.
- Install the Microsoft Exchange Online application from the ServiceNow Store and configure it to connect with your ServiceNow AI Platform instance, activating search and delete workflows.
Usage Workflow
- As an analyst with the snsi.analyst role, define search criteria on security incident records and submit email search requests.
- After locating suspicious emails, request deletion of those emails from Microsoft Exchange Online.
- If enabled, delete requests are routed to a configured approval group to ensure controlled removal.
- Microsoft Exchange administrators can optionally recover deleted emails if needed during incident remediation.
- Customize security tags in your ServiceNow AI Platform to visually track the status of email search and delete actions.
For the Microsoft Exchange Online integration application by ServiceNow, the ServiceNow AI Platform® Security Incident Response (SIR) product is integrated with the Microsoft Exchange Online service, one of the cloud-based services in the Microsoft Office 365 suite of products. Your Security Operation Center (SOC) analyst can search your corporate email environment for security-related threats and remove and remediate phishing emails with email search and delete capabilities.
Overview of Microsoft Exchange Online integration
As the security incident analyst, you execute the integration from the security analyst interface, and the workflow returns email message details that match search criteria. Email searches are based on criteria that include subject lines as well as sender and recipient email addresses. After the email search is complete, you can delete suspicious emails from the Microsoft Exchange Online service, and, an optional approval process can be configured to request approval prior to deleting emails.
This email search and delete integration can be used with a broader phishing response incident workflow or runbook. After a corporate user or employee receives a suspicious email and reports it to the company's phishing response team or inbox, the reported email is forwarded to the ServiceNow AI Platform and categorized as a security incident. After you have verified that an email is a phishing attack, as the analyst responsible for investigating phishing incidents, you can initiate an email search to determine if other corporate users have received this phishing email. The search allows you to locate related emails from the same phishing campaign and identify other potential victims who may have received the email, read it, and also potentially clicked a malicious URL or opened an attachment.
Key features
The integration includes the following key features:
- Configure search criteria for phishing threats in Security Incident Response based on combinations of the sender, recipient, and subject fields on email messages.
- For large and lengthy email searches, the security incident analyst is notified via email when the search has successfully completed, along with the number of matched messages.
- Status for individual messages informs you if recipients have read or deleted suspicious emails.
- If configured, optional approval processes ensure that suspicious emails are not deleted without prior approval.
- A complete audit trail for delete requests that includes the number of deleted emails is logged in the work notes of security incidents.
- If tagging is configured, security tags record when email search and delete workflows are initiated and successfully completed on security incidents.
Supported Microsoft Exchange Online versions
This integration supports Microsoft Exchange Online services, which are part of the Microsoft Office 365 suite. The integration does not support hosted Microsoft Exchange environments. Microsoft runs Microsoft Exchange Online services on the Exchange 2016 version.
Prerequisites
The com.snc.si_dep plugin is required for any ServiceNow AI Platform version. This plugin automatically installs all the dependencies that are required to support the Security Incident Response product. Install and activate this plugin before installing and activating the other Security Operations applications.
- Security Integration Framework
- Security Support Common
- Security Support Orchestration
- Security Incident Response