> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/email-security/mimecast.md).

# Mimecast

![Mimecast logo 2021](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-6fb2dc149fc86f2d0d760063d3e6884e63c19133%2Fmimecast-logo-dark-2021.png?alt=media)

Mimecast provides an API which allows for the retrieval of data directly into ThreatDefence.\
If you are using Mimecast, please follow this guide.

Before ThreatDefence can retrieve logs from Mimecast, you must:

* Identify your regional base URL.
* Enable enhanced logging.
* Add a custom API application.
* Create a new user profile and application setting.
* Generate API access and secret keys in the Mimecast administrator portal.

***

## Identify Your Base Domain URL

Copy and save the [base URL](https://integrations.mimecast.com/documentation/api-overview/global-base-urls/) for your host region.

***

## Mimecast Permissions

The table below shows the endpoints used by the collection scripts and required administrator permissions.\
All permissions are included in the **Basic Administrator** role.

| Endpoint                           | Permission       |
| ---------------------------------- | ---------------- |
| /api/login/discover-authentication | N/A              |
| /api/audit/get-audit-events        | Logs \| Read     |
| /api/audit/get-siem-logs           | Tracking \| Read |

***

## Step 1: Creating a User

1. Navigate to **Users & Groups → Internal Directories**.
2. Select the **Internal Domain** where you want to create the user.
3. Click **New Address**.
4. Complete the form. See [Managing User Email Addresses](https://mimecastsupport.zendesk.com/hc/en-us/articles/34000769619091-Directories-Managing-User-Email-Addresses) for details.

> **Note:** Keep a copy of the password. You will use it when setting up the scripts.

5. Click **Save and Exit**.

***

## Step 2: Adding the User to an Administrator Role

1. Navigate to **Users & Groups → Roles**.
2. Right-click the Administrator Role (e.g., Basic Administrator).
3. Select **Add Users to Role**.
4. Find the user created in [Step 1](#step-1-creating-a-user).
5. Select the checkbox next to the user.
6. Click **Add Selected Users**.

***

## Step 3: Creating a Group and Adding the User

1. Navigate to **Users & Groups → Profile Groups**.
2. Create a new group.

> **Note:** Give the group a descriptive name (e.g., TD Admin).

3. With the group selected, click **Build**.
4. Click **Add Email Addresses**.
5. Add the user created in [Step 1](#step-1-creating-a-user).
6. Click **Save and Exit**.

***

## Step 4: Creating an Authentication Profile

> **Note:** 2-step authentication must be disabled for this profile.

1. Navigate to **Users & Groups → Authentication Profiles**.
2. Click **New Authentication Profile**.
3. Enter a description.
4. Set **Authentication TTL** to *Never Expires*.
5. Leave other settings as default.
6. Click **Save and Exit**.

***

## Step 5: Creating an Application Setting

1. Navigate to **Users & Groups → Applications**.
2. Click **New Application Settings**.
3. Enter a description.
4. Select the group created in [Step 3](#step-3-creating-a-group-and-adding-the-user).
5. Select the authentication profile from [Step 4](#step-4-creating-an-authentication-profile).
6. Leave other settings as default.
7. Click **Save and Exit**.

***

## Step 6: Enabling Logging

1. Navigate to **Account → Account Settings**.
2. Expand the **Enhanced Logging** section.
3. Select the logs you want to enable:
   * **Inbound** — external senders to internal recipients.
   * **Outbound** — internal senders to external recipients.
   * **Internal** — between internal domains.
4. Click **Save**.

***

## Step 7: Registering an Integration

1. Navigate to **Services → API and Platform Integrations**.
2. Go to the **Available Integrations** tab and create a **V1 API Integration**
3. Click **Generate Keys**.
4. Enter a description.
5. Click **Next**.
6. Provide a technical point of contact name and email address.
7. (Optional) Select the **Opt-in** checkbox for update notifications.
8. Click **Next**, review the summary, and click **Add**.
9. Copy the **Application ID** and **Application Key**.

> **Note:** You must wait at least 30 minutes before obtaining an Access ID and Secret Key.

***

## Step 8: Configuration in ThreatDefence

Provide the following details to ThreatDefence at **<support@threatdefence.com>**:

* **MIMECAST\_API\_BASE\_URL** (e.g., `xx-api.mimecast.com`)
* **MIMECAST\_ACCOUNT\_CODE** (e.g., `CAU13A177`)
* **MIMECAST\_APP\_ID** (from [Step 5](#step-5-creating-an-application-setting))
* **MIMECAST\_APP\_KEY** (from [Step 5](#step-5-creating-an-application-setting))
* **MIMECAST\_ACCESS\_KEY** (from [Step 7](#step-7-registering-an-integration))
* **MIMECAST\_SECRET\_KEY** (from [Step 7](#step-7-registering-an-integration))

***

If you have any questions or need assistance, please contact us at **<support@threatdefence.com>**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/email-security/mimecast.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.