Exchange CIS Audit Crate

If you’re new to Crates, read through our introductory Crate documentation here. Find the Crate in our Crate Marketplace.

What does the Exchange CIS Audit Crate do?

This Crate automates the process of validating certain Center for Internet Security (CIS) controls such as audit logs and mailbox configurations, and logs a ticket in your PSA for record-keeping and potential remediation actions.

How the Crate works

• The workflow validates if audit logs are configured correctly per CIS controls.

• It confirms if mailbox settings align with specific CIS controls.

• A ticket is created in your integrated PSA, detailing the compliance status of each control validated.

• The ticket contains a detailed summary of all the controls checked, making it easier for remediation if necessary.

Crate prerequisites

The Microsoft Cloud Integration Bundle must be set up before unpacking this Crate.

Your PSA must successfully be integrated with Rewst.

Unpack the Exchange CIS Audit Crate

1. Navigate to Marketplace > Crates in the Rewst platform.

2. Search for Exchange CIS Audit.

3. Click on the Crate tile to begin unpacking.

4. Click Unpack Crate.

5. Click Continue.

6. Note that you have the option under the Cron Job accordion menu to activate the Crate for all future organizations in addition to the current one. You may also set activation to certain tags, trigger criteria, or for integration overrides.

7. Click Unpack.

Update the cron trigger

To test this Crate, you'll need to adjust the cron trigger's schedule to a few minutes in the future, then adjust it back to your regular schedule after the test. Alternatively, you could wait until the regularly scheduled run occurs and check your result, which would not require you to update the cron trigger schedule. Check in your PSA to ensure that the workflow creates a ticket as expected.

After unpacking, the default schedule for this Crate is once monthly, on the first day of each month.

1. Navigate to Automations > Workflows.

2. Search for [ROC] EXO: CIS Audit.

3. Click on the workflow to open it in the Workflow Builder.

4. Click on the trigger in the workflow to open its settings in the right side menu.

5. Update the timing of the cron trigger as desired in the fields under Trigger Parameters. Note that when entering the time into the Cron Schedule field, the correct format is minutes followed by hour. For example, 18 3, not 3 18.

6. Click Save Trigger.

Got an idea for a new Crate? Rewst is constantly adding new Crates to our Crate Marketplace. Submit your idea or upvote existing ideas here in our Canny feedback collector.