Collect Mimecast Mail logs

This document describes how you can collect Mimecast Secure Email Gateway logs by setting up a Google Security Operations feed.

For more information, see Data ingestion to Google Security Operations.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the MIMECAST_MAIL ingestion label.

Configure Mimecast Secure Email Gateway

1. Enable logging for the login account.
2. Create the API application.
3. Get the application ID and application key.

Enable logging for the login account

1. Sign in to the Mimecast Administration console.
2. In the Account menu, click Account Settings.
3. Expand Enhanced Logging.
4. Select the types of logs to enable:
   • Inbound: logs messages from external senders to internal recipients.
   • Outbound: logs messages from internal senders to external recipients.
   • Internal: logs messages within internal domains.
5. Click Save to apply the changes.

Create the API application

1. Sign in to the Mimecast Administration console.
2. Click Add API Application.
3. Enter the following details:
   1. Application name.
   2. Description for the application.
   3. Category: Enter one of the following categories:
   • SIEM Integration: provides real-time analysis of the security alerts generated by the application.
   • MSP Ordering and Provisioning: available for select partners to manage orders in the MSP Portal.
   • Email / Archiving: refers to messages and alerts stored in Mimecast.
   • Business Intelligence: enables application's infrastructure and tools to access and analyse information to improve and optimize decisions and performance.
   • Process Automation: allows for automation of business processes.
   • Other: in case the application doesn't fit within any other category.
4. Click Next.
5. Specify values for the following input parameters:
   • Authentication HTTP Header Configuration: enter authentication details in the following format: secret_key:{Access Secret}
access_key:{Access key}
app_id:{Application ID}
app_key:{application key}
   • API Hostname: fully qualified domain name of your Mimecast API endpoint. The typical format is xx-api.mimecast.com. If not provided, it will be region-specific in the US and Europe. This field cannot be empty for other regions.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label applied to the events from this feed.
6. Click Next.
7. Review the information displayed on the Summary Page.
8. To fix errors, follow these steps:
   • Click Edit buttons next to Details or Settings.
   • Click Next and go to the Summary page again.

Get the application ID and application key

1. Click Application and then click Services.
2. Click API Application.
3. Select the created API application.
4. View the application details.

Creating API access and secret key

For information about generating access and secret key, see Creating User Association Key.

Set up feeds

To configure this log type, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click the Mimecast feed pack.

4. Specify the values for the following fields:

   • Source Type: Third party API (recommended)
   • Authentication HTTP header: provide the providing the application ID, access key, secret ID, and application key.
   • API Hostname: specify the domain name of your Mimecast host.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

5. Click Create Feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

Field mapping reference

This parser extracts key-value pairs from Mimecast email server logs, categorizes the log entry stage (RECEIPT, PROCESSING, or DELIVERY), and maps the extracted fields to the UDM. It also performs specific logic to handle security-related fields, determining the security result action, category, severity, and related details based on values like Act, RejType, SpamScore, and Virus.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.