--- title: "Mimecast collector" canonical: "https://docs.devo.com/space/latest/184975456/Mimecast%20collector" format: markdown --- > Macro (excerpt-include) > Macro (toc) ## Purpose An analyst wants to detect phishing attempts that bypass traditional email security. Using the [Mimecast ](https://www.mimecast.com/)collector to send email security logs to Devo, the analyst will find targeted impersonation attacks aimed at executives. As a result, the analyst will block malicious senders, preventing them from stealing credentials or deploying malware. ## Example tables | **Table** | **Description** | | --- | --- | | `mail.mimecast.audit.events` | Audit Mimecast configuration changes | | `mail.mimecast.ttp.attachment` | Email attachments from targeted threat protection | | `mail.mimecast.ttp.impersonation` | Impersonation protection | | `mail.mimecast.ttp.url` | URLs from targeted threat protection | | `mail.mimecast.archive.search` | Properties of email searches | | `mail.mimecast.archive.messageview` | Email views | | `mail.mimecast.threat.feed` | Threats identified by Mimecast | | `mail.mimecast.message.list` | Properties of emails | | `mail.mimecast.message.summary` | Summary of emails | | `mail.mimecast.account.dashboard` | Dashboard activity | | `mail.mimecast.siem.*` | Security and information event management | | Union tables that use these tags: `mail.all` | Union tables collect information for monitoring purposes. | ## Authorize it Usually, a **Basic Administrator role **will suffice, which should allow you to use the same API keys generated for multiple API calls under the application.   | Service | Permissions | | --- | --- | | SIEM Audit | Gateway | Tracking | Read | | Audit | Account | Logs | Read | | TTP attachment | Monitoring | Attachment Protection | Read | | TTP impersonation | Monitoring | Impersonation Protection | Read | | TTP URL | Monitoring | URL Protection | Read | | Archive search | Archive | Search Logs | Read | | Archive view | Archive | View Logs | Read | | TTP Thread intel | Services | Gateway | Tracking | Read | | Message Hold List | Account | Dashboard | Read | | Message Hold Summary | Account | Monitoring | Held Summary | Read | | Dashboard | Account | Dashboard | Read | 1. Log on to the **Mimecast Administration Console**. 2. Click on the **Administration** toolbar button. 3. Select the **Services | API and Platform Integrations** menu item, and click on "**New Application**" to create an API application. 4. Enter a name and description for the application. 5. After creation, note your **Application ID **(`app_id`) and **Application Key **(`app_key`). 6. Create an **API service user account** by creating a role with appropriate permissions, and add the API service user to the role created. 7. Click on the **email address of the API service** user account. 8. Generate **Access Key** (`access_key`) and **Secret Key** (`secret_key`). 9. Copy all four keys (**Application ID**, **Application Key**, **Access Key**, and **Secret Key**). ## Run it In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Mimecast **collector instance. Insert this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new). ``` "inputs": { "mimecast_input": { "id": "", "enabled": true, "base_url": "", "auth_url": "", "pageSize": "", "autoconfig": { "refresh_interval_in_seconds": "", "creation_timeout_in_second": "" } }. "services": { "service_mimecast_client_api": { "last_configuration_timestamp": "", "endpoints": { "endpoints_1": { "name": "", "initial_lookback_period": "<1d>" } }, "service_mimecast_siem_client_api": { "last_configuration_timestamp": "", "endpoints": { "siem": { "initial_lookback_period": "<0d>", "page_token": "" } }, "credentials": { "client_id": "", "client_secret": "", "app_id": "", "app_key": "", "access_key": "", "secret_key": "" } } } } } ``` ## Secure it Devo Exchange provides these resources: - [Phishing (MITRE Att&ck Technique: T1566)](https://docs.devo.com/space/latest/326500411/Mitre+alert+packs+T1500-1599#Phishing) - Email Log Threat Detection Suite ## Monitor it Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source using the query ``` from mail.mimecast.audit.events where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id ``` Set the inactivity alert to keep track of the `collector_id`. ## Parameters ### Example ``` { "global_overrides": { "debug": false }, "inputs": { "mimecast_input": { "id": "", "enabled": true, "base_url": "your_base_url", "auth_url": "your_auth_url", "pageSize": "", "autoconfig": { "refresh_interval_in_seconds": "refresh_interval_value", "creation_timeout_in_second": "creation_timeout_value" }, "credentials": { "client_id": "your_client_id", "client_secret": "your_client_secret", "app_id": "your_app_id", "app_key": "your_app_key", "access_key": "your_access_key", "secret_key": "your_secret_key" }, "services": { "service_mimecast_client_api": { "last_configuration_timestamp": "last_configuration_timestamp_value", "request_period_in_seconds": seconds, "endpoints": [ { "endpoints_1": { "name": "audit", "initial_lookback_period": "1d" } }, { "endpoints_2": { "name": "attachments", "initial_lookback_period": "1d" } }, { "endpoints_3": { "name": "impersonation", "initial_lookback_period": "1d" } }, { "endpoints_4": { "name": "url", "initial_lookback_period": "1d" } }, { "endpoints_5": { "name": "search", "initial_lookback_period": "1d" } }, { "endpoints_6": { "name": "view", "initial_lookback_period": "1d" } }, { "endpoints_7": { "name": "threatfeed", "initial_lookback_period": "1d" } }, { "endpoints_8": { "name": "messageholdlist", "initial_lookback_period": "1d" } }, { "endpoints_9": { "name": "messageholdsummary", "initial_lookback_period": "1d" } }, { "endpoints_10": { "name": "dashboard", "initial_lookback_period": "1d" } } ] } } }, "mimecast_siem_input": { "id": "", "enabled": true, "requests_per_second": "requests_per_second_value", "base_url": "your_base_url", "auth_url": "your_auth_url", "pageSize": "page_size_value", "autoconfig": { "refresh_interval_in_seconds": "refresh_interval_value", "creation_timeout_in_second": "creation_timeout_value" }, "credentials": { "client_id": "your_client_id", "client_secret": "your_client_secret", "app_id": "your_app_id", "app_key": "your_app_key", "access_key": "your_access_key", "secret_key": "your_secret_key" }, "services": { "service_mimecast_siem_client_api": { "last_configuration_timestamp": "last_configuration_timestamp_value", "endpoints": { "siem": { "initial_lookback_period": "0d", "page_token": "" } } } } } } } ``` ### Details | **Parameter** | **Data type** | **Necessity** | **Details** | | --- | --- | --- | --- | | `id` | `string` | Mandatory | Alphanumeric identifier. | | `enabled` | `boolean` | Mandatory | Enables or disables the input. Format: `true`/`false` | | `base_url` | `string` | Mandatory | Base url for all the APIs
For v2 API `https://api.services.mimecast.com`
For v1 API, see: [Global Base URLs](https://integrations.mimecast.com/documentation/api-overview/global-base-urls/) | | `auth_url` | `string` | Mandatory | Auth url to generated auth token.
For v2 API: `"https://api.services.mimecast.com/oauth/token"` For v1:
Delete this parameter | | `credentials` | `dictionary` | Mandatory | Credentials to use the API.
For v2 API:
``` "credentials": { "client_id": "your_client_id", "client_secret": "your_client_secret" }, ```
For v1:
``` "credentials": { "app_id": "your_app_id", "app_key": "your_app_key", "access_key": "your_access_key", "secret_key": "your_secret_key" } ``` | | `endpoints` | `list` | Mandatory | An array with at least one endpoint, the collector will pull from the selected endpoints. Format:
``` [ { "endpoints_1": { "name": "audit", "initial_lookback_period": "1d" } } [ ``` | | `last_configuration_timestamp` | `string` | Mandatory | Change this value to a date after the initial configuration to reset the state of the collector.
Format: `yyyy-mm-ddThh:mm:ss.000Z` | | `request_period_in_seconds` | `integer` | Optional | Defaults to 60. Decrease this if data ingestion is delayed. Increase it if the collector hits a rate limit. | | `initial_lookback_period` | `string` | Mandatory | This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).
This value only has an effect for `mimecast_input`, `mimecast_siem_input` always pull from the last 7 days.
Example: `1d` | | `page_token` | `string` | Optional | Advanced theme: it is possible to put a pagination token from the collector to start fetching data from a given page. | Keep in mind that the Mimecast collector has two different inputs: - `mimecast_input` - `mimecast_siem_input` The collector can use both inputs or just one. Each input uses different endpoints and feeds different tables in Devo. Make sure to check the credentials given to determine the inputs and endpoints to use. ## API Endpoints | **Endpoint** | **Service** | **Table** | | --- | --- | --- | | `/api/ttp/attachment/get-logs` | Attachments | `mail.mimecast.ttp.attachment` | | `/api/audit/get-audit-events` | Audit | `mail.mimecast.audit.events` | | `/api/account/get-dashboard-notifications` | Dashboard | `mail.mimecast.account.dashboard` | | `/api/ttp/impersonation/get-logs` | Impersonation | `mail.mimecast.ttp.impersonation` | | `/api/gateway/get-hold-message-list` | Messageholdlist | `mail.mimecast.message.list` | | `/api/gateway/get-hold-summary-list` | Messageholdsummary | `mail.mimecast.message.summary` | | `/api/archive/get-search-logs` | Search | `mail.mimecast.archive.search` | | `/api/audit/get-siem-logs` | Siem | `mail.mimecast.siem.av` `mail.mimecast.siem.delivery` `mail.mimecast.siem.iep` `mail.mimecast.siem.impersonation` `mail.mimecast.siem.jrnl` `mail.mimecast.siem.process` `mail.mimecast.siem.receipt` `mail.mimecast.siem.spameventthread` `mail.mimecast.siem.ttp` | | `/siem/v1/batch/events/cg` | Siem (API v2) | `mail.mimecast.siem.attachment` `mail.mimecast.siem.av` `mail.mimecast.siem.delivery` `mail.mimecast.siem.iep` `mail.mimecast.siem.impersonation` `mail.mimecast.siem.jrnl` `mail.mimecast.siem.process` `mail.mimecast.siem.receipt` `mail.mimecast.siem.spam` `mail.mimecast.siem.url` | | `/api/ttp/threat-intel/get-feed` | Threatfeed | `mail.mimecast.threat.feed` | | `/api/ttp/url/get-logs` | Url | `mail.mimecast.ttp.url` | | `/api/archive/get-view-logs` | View | `mail.mimecast.archive.messageview` | ### API limits and duplicates The Mimecast API has some call rate limits. When a limit is reached, the collector shows a 429 error. More details about Mimecast limits can be found [here](https://integrations.mimecast.com/documentation/api-overview/rate-limiting/) and [here](https://developer.services.mimecast.com/docs/threatssecurityeventsanddataforcg/1/routes/siem/v1/batch/events/cg/get). Consider adjusting `request_period_in_seconds` to decrease or increase the ingestion rate. The Mimecast API sometimes sends duplicate events (it is not common). The collector tries to filter out the duplicates, but it is not possible to guarantee that all duplicates are deleted. ## Release Notes - **Version 2.4.0** (2025-06-24) - Fix the auth token api 429 errors - **Version 2.3.0 **(2025-06-05) - The DCSDK Docker base image has been updated from "1.3.1" to "1.5.1" - The DevoCollectorSDK Python package (devo-collector-sdk) has been updated from "1.13.1" to "1.16.2" - **Version 2.2.1** (2024-10-30) - Solved “Collector stops every 7 days” (INT-2957). - **Version 2.2.0** (2024-10-23) - The tags used for SIEM v2 have been changed, so they can use the new parsers that store data in the old tables. - Migrated to DCSDK version 1.13.1 - **Version 2.1.1** (2024-09-24) - Solved CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 updating base image. - **Version 2.1.0** (2024-09-20) - Integrated Mimecast API v2 for SIEM events, using Batch download. - New tables for new event formats. - Changed default cycle value to 300 seconds for SIEM service, to avoid 429 from the API. - Migrated to DCSDK version 1.12.4 - **Version 2.0.1 **(2024-08-05) - Integrated both Mimecast API v2 and API v1 - Deleted duplited SIEM events. - New parameter for SIEM service inicialization. - Some small fixes and changes for robustness. - Migrated to DCSDK version 1.12.2 - **Version 1.2.0** (2024-05-10) - Upgraded the mimecast api from v1 to v2. - Updated DCSDK from 1.10.2 to 1.11.1