Local exchange support ?

[serdarbayram01]

Hi ,

This script support on premise exchange 2013 can we use it on local exchange server ?

[gfoss]

This is not currently on the near-term roadmap. However, you can do most of the PIE functions just in a different way. For example, using the base Exchange log parsing along with the PIE dashboards for highlighting message flow data.

In order to get O365-Ninja to work, changing line #212's connectionURI value to the location of your Exchange server's powershell-API location may do the trick. There's some more info on how this works here.

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://<TARGET-SERVER>/powershell/ -Credential $cred -Authentication Basic -AllowRedirection

I haven't had a chance to test this, but from what I've read, it should work. Then you can make this into a SmartResponse by placing this script in a folder along with the existing actions.xml file similar to this folder structure. Then you can create the SmartResponse from this directory using the SIEM.