Collect Mimecast Mail logs

This document explains how to ingest Mimecast Mail logs to Google Security Operations using API. This parser extracts key-value pairs from Mimecast email server logs, categorizes the log stage (RECEIPT, PROCESSING, or DELIVERY), and maps the extracted fields to the UDM. It also performs specific logic for handling security results, including determining the action, category, severity, and threat information based on various fields like Act, RejType, SpamScore, and Virus.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to Mimecast Mail.

Configure Logging in Mimecast

1. Sign in to the Mimecast Administration Console.
2. Go to Administration > Account > Account Settings.
3. Select Enhanced Logging.
4. Enable the following log types:
   • Inbound
   • Outbound
   • Internal
5. Click Save.

Configure API in Mimecast

1. Go to Services > API and Platform Integrations.
2. Locate Mimecast API 1.0 and click Generate Keys.
3. Provide the following configuration details:
   • Application Name: (for example, Google SecOps).
   • Category: choose SIEM Integration.
   • Enable Extended Session on the Service Application.
   • Description: (for example, Google SecOps API integration).
   • Click Next.
4. Provide the following Notification configuration details:
   • Developer: enter the name of the technical point of contact.
   • Email: enter an email address for the technical point of contact.
   • Click Next.
5. Review the Summary information and click Add.
6. Copy and save the Application ID and Application Key.

Configure User Access and Secret Keys in Mimecast

1. Click the newly registered API Application from the application list.
2. Click Create Keys.
3. Provide the following configuration details:
   • Email Address: enter the email address of the dedicated administrator user account.
   • Click Next.
   • Authentication Type: select Cloud or Domain, depending on your configured authentication method.
   • Password: enter the password for the dedicated administrator user.
   • Click Next.
   • Copy both Access and Secret keys.
   • Click Next to exit the wizard.

Configure a feed in Google SecOps to ingest Mimecast Mail logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed; for example, Mimecast Mail Logs.
4. Select Third party API as the Source type.
5. Select Mimecast as the Log type.
6. Click Next.
7. Specify values for the following input parameters:
   • Authentication HTTP Header Configuration: enter authentication details in the following format: secret_key:{Access Secret}
access_key:{Access key}
app_id:{Application ID}
app_key:{application key}
   • API Hostname: fully qualified domain name of your Mimecast API endpoint. The typical format is xx-api.mimecast.com. If not provided, it will be region-specific in the US and Europe. This field cannot be empty for other regions.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label applied to the events from this feed.
8. Click Next.
9. Review the feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Changes

2025-02-06

Enhancement:

• Changed mapping of filename_for_malachite from target.process.file.full_path to principal.resource.name.
• Changed mapping of fileName from principal.process.file.full_path to target.process.file.full_path.

2025-01-23

Enhancement:

• Mapped md5 to target.file.md5.
• Changed mapping of filename_for_malachite from principal.resource.name to target.process.file.full_path.
• Mapped urlCategory to principal.url_metadata.categories.
• Mapped credentialTheft to security_result.detection_fields.
• Mapped reason to security_result.summary.

2024-11-13

Enhancement:

• Mapped URL to principal.url.

2024-08-05

Enhancement:

• Mapped sourceIp to principal.ip and principal.asset.ip.
• Mapped url to principal.url.
• Mapped msgid to network.email.mail_id.
• Mapped subject to network.email.subject.
• Mapped senderDomain, AttNames, and AttCnt to security_result.detection_fields.

2023-03-31

Enhancement:

• Mapped filename_for_malachite to principal.resource.name.
• Mapped fileName to principal.process.file.full_path.
• Mapped sha256 to target.file.sha256.
• Mapped sha1 to target.file.sha1.
• Added conditional check for aCode.

Need more help? Get answers from Community members and Google SecOps professionals.