Mimecast
Mimecast provides an API which allows for the retrieval of data directly into ThreatDefence. If you are using Mimecast, please follow this guide.
Before ThreatDefence can retrieve logs from Mimecast, you must:
Identify your regional base URL.
Enable enhanced logging.
Add a custom API application.
Create a new user profile and application setting.
Generate API access and secret keys in the Mimecast administrator portal.
Identify Your Base Domain URL
Copy and save the base URL for your host region.
Mimecast Permissions
The table below shows the endpoints used by the collection scripts and required administrator permissions. All permissions are included in the Basic Administrator role.
/api/login/discover-authentication
N/A
/api/audit/get-audit-events
Logs | Read
/api/audit/get-siem-logs
Tracking | Read
Step 1: Creating a User
Navigate to Administration → Directories → Internal Directories.
Select the Internal Domain where you want to create the user.
Click New Address.
Complete the form. See Managing User Email Addresses for details.
Note: Keep a copy of the password. You will use it when setting up the scripts.
Click Save and Exit.
Step 2: Adding the User to an Administrator Role
Navigate to Administration → Account → Roles.
Right-click the Administrator Role (e.g., Basic Administrator).
Select Add Users to Role.
Find the user created in Step 1.
Select the checkbox next to the user.
Click Add Selected Users.
Step 3: Creating a Group and Adding the User
Navigate to Administration → Directories → Profile Groups.
Create a new group.
Note: Give the group a descriptive name (e.g., TD Admin).
With the group selected, click Build.
Click Add Email Addresses.
Add the user created in Step 1.
Click Save and Exit.
Step 4: Creating an Authentication Profile
Note: 2-step authentication must be disabled for this profile.
Navigate to Administration → Services → Application → Authentication Profiles.
Click New Authentication Profile.
Enter a description.
Set Authentication TTL to Never Expires.
Leave other settings as default.
Click Save and Exit.
Step 5: Creating an Application Setting
Navigate to Administration → Services → Applications.
Click New Application Settings.
Enter a description.
Select the group created in Step 3.
Select the authentication profile from Step 4.
Leave other settings as default.
Click Save and Exit.
Step 6: Enabling Logging
Navigate to Administration → Account → Account Settings.
Expand the Enhanced Logging section.
Select the logs you want to enable:
Inbound — external senders to internal recipients.
Outbound — internal senders to external recipients.
Internal — between internal domains.
Click Save.
Step 7: Registering an Integration
Navigate to Administration → Services → API and Platform Integrations.
Go to the Available Integrations tab.
Click Generate Keys.
Enter a description.
Click Next.
Provide a technical point of contact name and email address.
(Optional) Select the Opt-in checkbox for update notifications.
Click Next, review the summary, and click Add.
Copy the Application ID and Application Key.
Note: You must wait at least 30 minutes before obtaining an Access ID and Secret Key.
Step 8: Configuration in ThreatDefence
Provide the following details to ThreatDefence at [email protected]:
MIMECAST_API_BASE_URL (e.g.,
xx-api.mimecast.com)MIMECAST_ACCOUNT_CODE (e.g.,
CAU13A177)MIMECAST_APP_ID (from Step 5)
MIMECAST_APP_KEY (from Step 5)
MIMECAST_ACCESS_KEY (from Step 7)
MIMECAST_SECRET_KEY (from Step 7)
If you have any questions or need assistance, please contact us at [email protected].
Last updated