STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

Exchange queue monitoring must be configured with threshold and action.

DISA Rule

SV-259584r960918_rule

Vulnerability Number

V-259584

Group Title

SRG-APP-000111

Rule Version

EX19-ED-000040

Severity

CAT II

CCI(s)

• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.

Weight

10

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

perfmon

In the left pane, navigate to Performance >> Data Collector Sets >> User Defined.

In left pane, right-click User Defined >> New >> Data Collector Set and configure the system to use the data collection set for monitoring the queues.

Check Contents

Note: By default, there are two user-defined data collector sets created by Exchange: ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog. These are not providing enough data to monitor SMTP queues per the requirement. Additionally, if a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability Not Applicable.

Open the Exchange Management Shell and enter the following command:

perfmon

In the left pane, navigate to Performance >> Data Collector Sets >> User Defined.

If no sets are defined or queues are not being monitored, this is a finding.

Vulnerability Number

V-259584

Documentable

False

Rule Version

EX19-ED-000040

Severity Override Guidance

Note: By default, there are two user-defined data collector sets created by Exchange: ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog. These are not providing enough data to monitor SMTP queues per the requirement. Additionally, if a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability Not Applicable.

Open the Exchange Management Shell and enter the following command:

perfmon

In the left pane, navigate to Performance >> Data Collector Sets >> User Defined.

If no sets are defined or queues are not being monitored, this is a finding.

Check Content Reference

M

Target Key

5579