...
Introduction
The tags beginning with mailcloud.mimecastaws identify events generated by Mimecast.
...
The full tag must have 4 levels. The first two are fixed as mailcloud.mimecastaws. The third level identifies the type of events sent, and the fourth level indicates the event subtype
...