Malware Notificaties Admins

<# .SYNOPSIS Malware Notifications to Admins .DESCRIPTION Ensures admins receive notifications when malware is detected. Critical for security awareness and incident response. .NOTES Filename: malware-notifications-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\malware-notifications-admins.ps1 -Monitoring Check if admin malware notifications are configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Malware Notifications to Admins" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Malware Notifications to Admins .DESCRIPTION Ensures admins receive notifications when malware is detected. Critical for security awareness and incident response. .NOTES Filename: malware-notifications-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\malware-notifications-admins.ps1 -Monitoring Check if admin malware notifications are configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Malware Notifications to Admins" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking malware filter policies..." -ForegroundColor Gray $policies = Get-MalwareFilterPolicy -ErrorAction Stop $result = @{ isCompliant = $false totalPolicies = $policies.Count withNotifications = 0 } foreach ($policy in $policies) { $notifyInternal = $policy.InternalSenderAdminAddress.Count -gt 0 $notifyExternal = $policy.ExternalSenderAdminAddress.Count -gt 0 if ($notifyInternal -or $notifyExternal) { $result.withNotifications++ $result.isCompliant = $true Write-Host " [OK] NOTIFICATIONS CONFIGURED: $($policy.Name)" -ForegroundColor Green if ($notifyInternal) { Write-Host " Internal sender notifications: $($policy.InternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } if ($notifyExternal) { Write-Host " External sender notifications: $($policy.ExternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } } else { Write-Host " ⚠️ NO NOTIFICATIONS: $($policy.Name)" -ForegroundColor Yellow } } Write-Host "`n Total policies: $($result.totalPolicies)" -ForegroundColor Cyan Write-Host " With admin notifications: $($result.withNotifications)" -ForegroundColor $( if ($result.withNotifications -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Configure admin notifications!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Configure malware notifications via Exchange Admin Center" -ForegroundColor Yellow Write-Host "`nSteps:" -ForegroundColor Cyan Write-Host " 1. Exchange Admin Center > Mail flow > Rules" -ForegroundColor Gray Write-Host " 2. Or: Security & Compliance > Threat management > Policy" -ForegroundColor Gray Write-Host " 3. Anti-malware > Edit default policy" -ForegroundColor Gray Write-Host " 4. Notifications section:" -ForegroundColor Gray Write-Host " • Notify internal sender: Add admin email" -ForegroundColor Gray Write-Host " • Notify admin about undelivered: Add admin email" -ForegroundColor Gray Write-Host " 5. Save changes" -ForegroundColor Gray Write-Host "`n📝 Recommended notification recipients:" -ForegroundColor Cyan Write-Host " • Security team email (security@domain.com)" -ForegroundColor Gray Write-Host " • SOC team" -ForegroundColor Gray Write-Host " • IT helpdesk" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking malware filter policies..." -ForegroundColor Gray $policies = Get-MalwareFilterPolicy -ErrorAction Stop $result = @{ isCompliant = $false totalPolicies = $policies.Count withNotifications = 0 } foreach ($policy in $policies) { $notifyInternal = $policy.InternalSenderAdminAddress.Count -gt 0 $notifyExternal = $policy.ExternalSenderAdminAddress.Count -gt 0 if ($notifyInternal -or $notifyExternal) { $result.withNotifications++ $result.isCompliant = $true Write-Host " [OK] NOTIFICATIONS CONFIGURED: $($policy.Name)" -ForegroundColor Green if ($notifyInternal) { Write-Host " Internal sender notifications: $($policy.InternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } if ($notifyExternal) { Write-Host " External sender notifications: $($policy.ExternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } } else { Write-Host " ⚠️ NO NOTIFICATIONS: $($policy.Name)" -ForegroundColor Yellow } } Write-Host "`n Total policies: $($result.totalPolicies)" -ForegroundColor Cyan Write-Host " With admin notifications: $($result.withNotifications)" -ForegroundColor $( if ($result.withNotifications -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Configure admin notifications!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Malware Notifications to Admins .DESCRIPTION Ensures admins receive notifications when malware is detected. Critical for security awareness and incident response. .NOTES Filename: malware-notifications-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\malware-notifications-admins.ps1 -Monitoring Check if admin malware notifications are configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Malware Notifications to Admins" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking malware filter policies..." -ForegroundColor Gray $policies = Get-MalwareFilterPolicy -ErrorAction Stop $result = @{ isCompliant = $false totalPolicies = $policies.Count withNotifications = 0 } foreach ($policy in $policies) { $notifyInternal = $policy.InternalSenderAdminAddress.Count -gt 0 $notifyExternal = $policy.ExternalSenderAdminAddress.Count -gt 0 if ($notifyInternal -or $notifyExternal) { $result.withNotifications++ $result.isCompliant = $true Write-Host " [OK] NOTIFICATIONS CONFIGURED: $($policy.Name)" -ForegroundColor Green if ($notifyInternal) { Write-Host " Internal sender notifications: $($policy.InternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } if ($notifyExternal) { Write-Host " External sender notifications: $($policy.ExternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } } else { Write-Host " ⚠️ NO NOTIFICATIONS: $($policy.Name)" -ForegroundColor Yellow } } Write-Host "`n Total policies: $($result.totalPolicies)" -ForegroundColor Cyan Write-Host " With admin notifications: $($result.withNotifications)" -ForegroundColor $( if ($result.withNotifications -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Configure admin notifications!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Configure malware notifications via Exchange Admin Center" -ForegroundColor Yellow Write-Host "`nSteps:" -ForegroundColor Cyan Write-Host " 1. Exchange Admin Center > Mail flow > Rules" -ForegroundColor Gray Write-Host " 2. Or: Security & Compliance > Threat management > Policy" -ForegroundColor Gray Write-Host " 3. Anti-malware > Edit default policy" -ForegroundColor Gray Write-Host " 4. Notifications section:" -ForegroundColor Gray Write-Host " • Notify internal sender: Add admin email" -ForegroundColor Gray Write-Host " • Notify admin about undelivered: Add admin email" -ForegroundColor Gray Write-Host " 5. Save changes" -ForegroundColor Gray Write-Host "`n📝 Recommended notification recipients:" -ForegroundColor Cyan Write-Host " • Security team email (security@domain.com)" -ForegroundColor Gray Write-Host " • SOC team" -ForegroundColor Gray Write-Host " • IT helpdesk" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Configure malware notifications via Exchange Admin Center" -ForegroundColor Yellow Write-Host "`nSteps:" -ForegroundColor Cyan Write-Host " 1. Exchange Admin Center > Mail flow > Rules" -ForegroundColor Gray Write-Host " 2. Or: Security & Compliance > Threat management > Policy" -ForegroundColor Gray Write-Host " 3. Anti-malware > Edit default policy" -ForegroundColor Gray Write-Host " 4. Notifications section:" -ForegroundColor Gray Write-Host " • Notify internal sender: Add admin email" -ForegroundColor Gray Write-Host " • Notify admin about undelivered: Add admin email" -ForegroundColor Gray Write-Host " 5. Save changes" -ForegroundColor Gray Write-Host "`n📝 Recommended notification recipients:" -ForegroundColor Cyan Write-Host " • Security team email (security@domain.com)" -ForegroundColor Gray Write-Host " • SOC team" -ForegroundColor Gray Write-Host " • IT helpdesk" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Malware Notifications to Admins .DESCRIPTION Ensures admins receive notifications when malware is detected. Critical for security awareness and incident response. .NOTES Filename: malware-notifications-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\malware-notifications-admins.ps1 -Monitoring Check if admin malware notifications are configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Malware Notifications to Admins" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking malware filter policies..." -ForegroundColor Gray $policies = Get-MalwareFilterPolicy -ErrorAction Stop $result = @{ isCompliant = $false totalPolicies = $policies.Count withNotifications = 0 } foreach ($policy in $policies) { $notifyInternal = $policy.InternalSenderAdminAddress.Count -gt 0 $notifyExternal = $policy.ExternalSenderAdminAddress.Count -gt 0 if ($notifyInternal -or $notifyExternal) { $result.withNotifications++ $result.isCompliant = $true Write-Host " [OK] NOTIFICATIONS CONFIGURED: $($policy.Name)" -ForegroundColor Green if ($notifyInternal) { Write-Host " Internal sender notifications: $($policy.InternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } if ($notifyExternal) { Write-Host " External sender notifications: $($policy.ExternalSenderAdminAddress.Count) recipients" -ForegroundColor Cyan } } else { Write-Host " ⚠️ NO NOTIFICATIONS: $($policy.Name)" -ForegroundColor Yellow } } Write-Host "`n Total policies: $($result.totalPolicies)" -ForegroundColor Cyan Write-Host " With admin notifications: $($result.withNotifications)" -ForegroundColor $( if ($result.withNotifications -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Configure admin notifications!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Configure malware notifications via Exchange Admin Center" -ForegroundColor Yellow Write-Host "`nSteps:" -ForegroundColor Cyan Write-Host " 1. Exchange Admin Center > Mail flow > Rules" -ForegroundColor Gray Write-Host " 2. Or: Security & Compliance > Threat management > Policy" -ForegroundColor Gray Write-Host " 3. Anti-malware > Edit default policy" -ForegroundColor Gray Write-Host " 4. Notifications section:" -ForegroundColor Gray Write-Host " • Notify internal sender: Add admin email" -ForegroundColor Gray Write-Host " • Notify admin about undelivered: Add admin email" -ForegroundColor Gray Write-Host " 5. Save changes" -ForegroundColor Gray Write-Host "`n📝 Recommended notification recipients:" -ForegroundColor Cyan Write-Host " • Security team email (security@domain.com)" -ForegroundColor Gray Write-Host " • SOC team" -ForegroundColor Gray Write-Host " • IT helpdesk" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }