OpenControls Logo

STIG Viewer

STIGViewer Support

Exchange Queue monitoring must be configured with threshold and action.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-221209EX16-ED-000080SV-221209r960918_ruleCCI-000154medium
Description
Monitors are automated "process watchers" that respond to performance changes and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alerts if thresholds are reached, better enabling them to react in a timely fashion. This field offers choices of alerts when a "warning" or "critical" threshold is reached on the SMTP queue. A good rule of thumb (default) is to issue warnings when SMTP queue growth exceeds 10 minutes and critical messages when it exceeds 20 minutes, which should only exist occasionally. Frequent alerts against this counter may indicate a network or other issue (such as inbound SPAMMER traffic) that directly impacts email delivery. Notification choices include email alert to an email-enabled account (e.g., an email Administrator) or invoke a script to take other action (e.g., to add an Event to the Microsoft Application Event Log, where external monitors might detect it).
STIGDate
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide2024-12-06

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (43) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+33 more (top 10 by confidence shown)

CCI1 mapping
CCI-000154
1.00

Details

Check Text (C-221209r960918_chk)

Note: If a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability NA. Open the Exchange Management Shell and enter the following command: perfmon In the left pane, navigate to Performance >> Data Collector Sets >> User Defined. If no sets are defined or queues are not being monitored, this is a finding.

Fix Text (F-22913r411754_fix)

Open the Exchange Management Shell and enter the following command: perfmon In the left pane, navigate to Performance >> Data Collector Sets >> User Defined. In left pane, right-click on User Defined >> New >> Data Collector Set and configure the system to use the data collection set for monitoring the queues.