Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Attribute review] Align MT and ORCA check attributes with CIS

Open Beginner friendly
  • Is something wrong?
#2,482 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
powershell
Domain
security, testing

Research direction

Start with PR #2410 and the CIS counterparts it identifies, then locate the ORCA.118.1 generator or source template and the test definitions for MT.1175, MT.1173, MT.1041, and MT.1044. Update the listed attributes to match the stated CIS values; regenerate ORCA.118.1 from its source. Done when all five attributes match the issue and the generated test reflects the template change.

Written by the indexing model from the issue text.

Description

enhancement product: defender product: exchange product: purview status: needs triage suite: orca

Scope

Follow up the cross-suite attribute recommendations from PR #2410 that point to tests outside that pull request. The CIS counterparts in PR #2410 already use the recommended values. For ORCA.118.1, update its generator or source template and regenerate the test; do not hand-edit generated output.

  • ORCA.118.1: change Severity from High to Medium to match CIS.M365.2.1.14 for the AllowedSenderDomains anti-spam setting. The exposure is limited to explicitly allowed senders and requires spoofing or compromising one of those domains.
  • MT.1175: Severity is already Medium, matching CIS.M365.3.2.3; no source change was needed. The control covers the Copilot workload, and the documented attack requires an existing session.
  • MT.1173: change Severity from Medium to Low to match CIS.M365.3.3.1. Publishing sensitivity labels without enforcement is hygiene with a small security effect on its own.
  • MT.1041: change ResourceType from Tenant to Policy to match CIS.M365.6.3.1. The check evaluates the default and mailbox-assigned role assignment policies and reports failing policies.
  • MT.1044: change Severity from High to Low to match CIS.M365.6.5.1. When OAuth2ClientProfileEnabled is off, Outlook connections fail to sign in; this is an outage rather than disabling a security control.

Attribute review follow-ups from PR #2410.

Completed attribute updates are in commit 429015e7; MT.1173 remains open.

Dominant language
PowerShell
Stars
1.1k
Forks
288
Avg merge
21h 7m
Merged PRs (30d)
179

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from maester365/maester

All issues in maester365/maester

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.