ORCA.242: Important protection alerts responsible for AIR activities are enabled.
| ID | ORCA.242 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Tenant settings |
| Security area | Logging and detection |
| Resource type | Policy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-4(5) System Monitoring | System-generated Alerts |
| MITRE ATT&CK | T1566 |
| Reads from | Exchange Online, Security & Compliance PowerShell |
| Licence needed | ATP_ENTERPRISE |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Automated Incident Response (AIR) triggers off certain alerts that fire in the environment. AIR is responsible for detecting further anomalies and providing automated remediation actions designed to mitigate threats/attacks. It is important that these alerts are enabled so that AIR can function correctly.
Remediation action
Section titled “Remediation action”Enable important protection alerts that are responsible for AIR activities.
Related Links
Section titled “Related Links”Mito check, based on ORCA. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.