Skip to content

Commit 0b3cd3c

Browse files
amee-sumoamee-sumo
authored
Update Mimecast app (#5653)
1 parent a69e08c commit 0b3cd3c

File tree

1 file changed

+33
-36
lines changed

1 file changed

+33
-36
lines changed

‎docs/integrations/saas-cloud/mimecast.md‎

Lines changed: 33 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Key features of the Mimecast app include:
1818

1919
## Log types
2020

21-
The app uses Mimecast Source to collect [SIEM](https://integrations.mimecast.com/documentation/tutorials/understanding-siem-logs/) and [DLP](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-dlp-logs/) logs from Mimecast platform.
21+
The app uses [Mimecast Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mimecast-source/) to collect [SIEM](https://developer.services.mimecast.com/siem-tutorial-cg) and [DLP](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-dlp-logs/) logs from Mimecast platform.
2222

2323
## Sample log messages
2424

@@ -27,31 +27,28 @@ The app uses Mimecast Source to collect [SIEM](https://integrations.mimecast.com
2727

2828
```json title="SIEM Log"
2929
{
30-
"datetime": "2023-04-28T07:20:21+0000",
31-
"acc": "C0A0",
32-
"aCode": "7O7I7MvGjghgfhh",
33-
"IP": "89.189.94.111",
34-
"Dir": "Internal",
35-
"MsgId": "<messageId@messageId>",
36-
"Subject": "message subject",
37-
"headerFrom": "[email protected]",
38-
"Sender": "[email protected]",
39-
"Rcpt": "[email protected]",
40-
"SpamInfo": "[]",
41-
"Act": "Acc",
42-
"TlsVer": "TLSv1",
43-
"Cphr": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
44-
"SpamProcessingDetail": {
45-
"spf": {
46-
"info": "SPF_FAIL",
47-
"allow": true
48-
},
49-
"dkim": {
50-
"info": "DKIM_UNKNOWN",
51-
"allow": true
52-
}
53-
},
54-
"SpamScore": "1"
30+
"processingId": "processingId",
31+
"aggregateId": "aggregateId",
32+
"spamProcessingDetail": "Spam Processing Detail",
33+
"numberAttachments": "1",
34+
"subject": "siem_recipient - email subject line",
35+
"tlsVersion": "TLSv1.2",
36+
"senderEnvelope": "[email protected]",
37+
"messageId": "messageId",
38+
"senderHeader": "[email protected]",
39+
"rejectionType": "rejectionType",
40+
"eventType": "receipt",
41+
"accountId": "C0A0",
42+
"recipients": "[email protected]",
43+
"tlsCipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
44+
"action": "Allow",
45+
"subType": "Allow",
46+
"spamInfo": null,
47+
"senderIp": "123.123.123.123",
48+
"timestamp": 1689685338597,
49+
"direction": "Inbound",
50+
"spamScore": "0",
51+
"spamDetectionLevel": "0"
5552
}
5653
```
5754
```json title="DLP Log"
@@ -74,18 +71,18 @@ The app uses Mimecast Source to collect [SIEM](https://integrations.mimecast.com
7471
<summary>View Sample Queries</summary>
7572

7673
```sql title="Messages Delivered Without TLS"
77-
_sourceCategory="mimecast_app" Delivered Dir
78-
| json "aCode","Delivered","UseTls" as a_code, delivered, use_tls nodrop
79-
| where delivered="true"
80-
| where use_tls="No"
81-
| count_distinct(a_code)
74+
_sourceCategory=Labs/mimecast delivered direction
75+
| json "accountId","delivered","tlsUsed" as account_id, delivered, use_tls nodrop
76+
| where delivered="true"
77+
| where use_tls="false"
78+
| count(account_id)
8279
```
8380

8481
```sql title="DLP Events Over Time"
85-
_sourceCategory="mimecast_app" messageId policy action
82+
_sourceCategory=Labs/mimecast messageId policy action
8683
| json "messageId","policy","action","route","recipientAddress","senderAddress" as message_id, policy, action, route, recipient, sender nodrop
8784
| timeslice 1d
88-
| count_distinct(message_id) as frequency by _timeslice
85+
| count(message_id) as frequency by _timeslice
8986
| fillmissing timeslice
9087
```
9188
</details>
@@ -123,12 +120,12 @@ The panels will begin to fill automatically. It's worth noting that each panel g
123120

124121
### Overview
125122

126-
The **Mimecast - Overview** dashboard provides a comprehensive view of the message logs and related Data Loss Prevention(DLP) policies. This dashboard provides insight into the total number of messages delivered and messages delivered and received without TLS. Additionally, this dashboard enables monitoring of messages that triggered DLP policies over time, the top 10 DLP policies, and a summary of recent messages that triggered DLP.<br/><img src={useBaseUrl('img/integrations/saas-cloud/Mimecast-Overview.png')} alt="Mimecast-Overview" />
123+
The **Mimecast - Overview** dashboard provides a comprehensive view of the message logs and related Data Loss Prevention(DLP) policies. This dashboard provides insight into the total number of messages delivered and messages delivered and received without TLS. Additionally, this dashboard enables monitoring of messages that triggered DLP policies over time, the top 10 DLP policies, and a summary of recent messages that triggered DLP.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Mimecast/Mimecast+-+Overview+new.png' alt="Mimecast-Overview" />
127124

128125
### Email Activity Summary
129126

130-
The **Mimecast - Email Activity Summary** dashboard provides a comprehensive view of the message traffic for both incoming and outgoing messages. This dashboard provides insight into the geographic locations of senders and recipients, rejection types for messages, received message status, delivered message direction, and a summary of both message types. Additionally, this dashboard displays information on the most frequently used ciphers, domains that are not using TLS, and reasons for messages being on hold.<br/><img src={useBaseUrl('img/integrations/saas-cloud/Mimecast-Email-Activity-Summary.png')} alt="Mimecast-Email-Activity-Summary"/>
127+
The **Mimecast - Email Activity Summary** dashboard provides a comprehensive view of the message traffic for both incoming and outgoing messages. This dashboard provides insight into the geographic locations of senders and recipients, rejection types for messages, received message status, delivered message direction, and a summary of both message types. Additionally, this dashboard displays information on the most frequently used ciphers, domains that are not using TLS, and reasons for messages being on hold.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Mimecast/Mimecast+-+Email+Activity+Summary+new.png' alt="Mimecast-Email-Activity-Summary" />
131128

132129
### Target Threat Protection
133130

134-
The **Mimecast - Target Threat Protection** dashboard provides a comprehensive view of the threat protection logs resulting from any malicious activity. This dashboard provides a summary of the recent attachment threats detected, recent activity on malicious URLs, and recent blocked emails. Additionally, this dashboard provides insight into the top 10 recipients and senders of malicious attachment messages and the top 10 malicious senders and targeted recipients.<br/><img src={useBaseUrl('img/integrations/saas-cloud/Mimecast-Target-Threat-Protection.png')} alt="Mimecast-Target-Threat-Protection" width="750"/>
131+
The **Mimecast - Target Threat Protection** dashboard provides a comprehensive view of the threat protection logs resulting from any malicious activity. This dashboard provides a summary of the recent attachment threats detected, recent activity on malicious URLs, and recent blocked emails. Additionally, this dashboard provides insight into the top 10 recipients and senders of malicious attachment messages and the top 10 malicious senders and targeted recipients.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Mimecast/Mimecast+-+Target+Threat+Protection+new.png' alt="Mimecast-Target-Threat-Protection" />

0 commit comments

Comments
 (0)