1.6 Ensure 'SCL Quarantine' is 'Enabled'

Information

Spam Confidence Level (SCL) is a rating assigned to incoming email messages by the Content Filter agent in Exchange Server. It is a measure of the likelihood that an email is spam based on various content analysis techniques and spam detection algorithms. The SCL value ranges from 0 to 9, with 9 being the highest level of confidence that the email is spam.

Ensure SCLQuarantineEnabled is set to True

Rationale:

E-mails with a high Spam Confidence Level (SCL) will be quarantined. This involves moving it to a designated quarantine e-mail address, separating it from the regular inbox of the recipient in order to prevent users interacting with malicious e-mails.

Impact:

False positives may occur when setting SCLQuarantineThreshold to lower values.

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-ContentFilterConfig -SCLQuarantineEnabled $true -SCLRejectThreshold 8 -SCLQuarantineThreshold 6

NOTE: The SCLRejectThreshold must be greater than the SCLQuarantineThreshold when enabling the Quarantine and is why it is changed in this instance.

Default Value:

SCLQuarantineEnabled: False

SCLQuarantineThreshold: 9

SCLRejectThreshold: 7

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8a.

Plugin: Windows

Control ID: d07db4190db5a1ee54734bab926dcb35e5c84148044a34391b57011a270b879b