Page Comparison

...

Mimecast is a cloud-based, anti-spam, and archive filtering service for securing email accounts and communications for businesses. This collector protects an enterprise’s email infrastructure from viruses, malware, phishing, and the rise of deep-fake attacks. It also makes it possible to automate the recovery of archived and affected emails for continuous use. It can predict and anticipate attacks and deal with losses from ransomware attacks using data archiving.

The Devo Mimecast Collector uses the Mimecast API to extract all the relevant information and send it as events to Devo.

...

There are some requirements to configure the Mimecast collector:

Accessing your API applications.
Creating user API keys. Refer to the Mimecast official documentation for more information.
Accessing your API applications.

Expand

title	Click here to know how to access Access your API applications

Log in to the Administration Console.
Click on the Administration toolbar button.
Select the Services/API and Platform Integrations menu item.

Once your API applications display you can:

Add an application.
Edit an application.
Delete an application.

Info
Refer to the Mimecast official documentation for more information.

...

Expand

title	Create API keys

Scroll to the middle of API Concepts for detailed instructions.

Authentication

The Mimecast Collector API 2.0 needs four two keys that the API uses, the four keys are:

API Application Client ID (appclient_id).API Key
Client secret (app_key).
Access Key(access_key).
Secret Key(secret_key).client_secret)

Expand

title	Credentials

API Application ID & API Key

Click Add API Application.

2. Fill in the Details section below and click Next.

3. Fill in the Settings section as outlined below and click Next.

Image Removed

4. Review the Summary page to ensure all details are correct. To fix any errors:

Click on the Edit link next to the Details or Settings to return to the relevant page.
Make your changes and click on the Next button to proceed to the Summary page again.

5. Click on the Add button. The Add API Application panel will display.

Image Removed

6. Copy the Application ID and the Application Key.

7. Wait 30 minutes and click on the application. Click the X button to return to the list of API applications.

Access Key & Secret Key

Click on API Application from the application list.
Click Create Keys. A Create Keys wizard displays with the Account tab selected.
Enter the Email Address of your service account.
Click next.
Complete the Authentication dialog.
Image Removed
Enter the Code within 15 minutes.
Click Next. The keys tab is displayed with the generated keys hidden by default.

Permissions

Follow these steps if you want to create a custom administrative role for the API service account user:

Navigate to Administration → Account → Roles.
Click New Role.
Enter a Role Name and Description.
In the Application Permissions section select the boxes for each required role to be used by the service account. Click Save.
Locate the newly created role and click on the role name.
Click Add User to Role.
Click on the email address of the API service user account.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Steps and information to generate these keys can be found in this article.

Rw ui tabs macro

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

Expand

title	Permissions

Each API call has a prerequisite section that tells you what permissions are needed for the call. Usually, a basic administrator role will be enough, which should allow you to use the same API keys generated for multiple API calls under the application.

If you want to create a custom administrative role for this API service account user, follow these steps:

Navigate to Administration → Account → Roles.
Click New Role.
Enter a Role Name and Description.
In the Application Permissions section, select the boxes for each required role to be used by the service user account.
Click Save and Exit.
Locate the newly created role and click on the role name.
Click Add User to Role.
Select the email address of the API service user account.

If you want to add the service account user to an existing role:

Navigate to Administration → Account → Roles.
Click on the administrator role the user will be added to.
Click Add User to Role.
Select the email address of the API service user account.

Find more details in the Customer Community.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

{ "mimecast_input": { "id": "<short_unique_identifier>", "enabled": true, "requests_per_second": 5, "base_url": "your_base_url", "pageSize": 1000, "autoconfig": { "refresh_interval_in_seconds": 60, "creation_timeout_in_second": 60 }, "credentials": { "app_id": "your_app_id", "app_key": "your_app_key", "access_key": "your_access_key", "secret_key": "your_secret_key" }, "services": { "service_mimecast_client_api": { "last_configuration_timestamp": "2021-12-02T13:10:00.000Z", "endpoints": [ { "endpoints_1": { "name": "audit

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Rw ui tabs macro

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note
Replace `<product_name>` with the proper value.

Editing the config.yaml file

Code Block

globals:
  debug: truefalse
  id: not_used
  name: mimecast._collector
  persistence:
    type: filesystem
    config:
      directory_name: state
  multiprocessing:
false   queue_max_size_in_mbmessages: 10241000
  queue_max_size_in_messages: 1000
  queue_max_elapsed_time_in_sec: 60
  queue_wrap_max_size_in_messages: 100

outputs:
#  devo_1:
#    type: devo_platform
#    config:
#      address: Collector Address
collector-us.devo.io
#      port: Port443
#      type: SSL
#      chain: Path/to/chain.crt
#      cert: Path/to/cert<devo_domain>.crt
#      key: Path/to/key.crt<devo_domain>.key
#  devo_2:
#    type: devo_platform
#    config:
#      address: collector-eu.devo.io
#      port: 443
#      type: SSL
#      chain: chain.crt
#      cert: <devo_domain>.crt
#      key: <devo_domain>.key
#  relay_1:
#    type: syslog
#    config:
#      address: 172.1.1.1
#      port: 13000
#      period_sender_stats_in_seconds: 60
#      concurrent_connections: 2
#  console_1:
#    type: console

inputs:
  mimecast_input:
    id: <short_unique_identifier>1
    enabled: falsetrue
    requests_per_second: 5
    base_url: your_base_url
    pageSizeauth_url: your_auth_url
    pageSize: 1000
    autoconfig:
      refresh_interval_in_seconds: 60      # Runs the setup every x seconds (default 600)
      creation_timeout_in_second: 60        # Set up the setup timeout (default 60)
    credentials:
      appclient_id: your<client_app_id
      app_key: your_app_key_value>
      access_key: your_access_key
      secret_key: yourclient_secret: <client_secret_keyvalue>
    services:
      service_mimecast_client_api:
        last_configuration_timestamp: 2021-12-02T13:10:00Z # change this if you want to get your state changed!
        endpoints:
          - endpoints_1:
              name: audit
              initial_lookback_period: 1d
          - endpoints_2:
              name: attachments
              initial_lookback_period: 1d
          - endpoints_3:
              name: impersonation
              initial_lookback_period: 1d
          - endpoints_4:
              name: url
              initial_lookback_period: 1d
          - endpoints_5:
              name: search
              initial_lookback_period: 1d
          - endpoints_6:
              name: view
              initial_lookback_period: 1d
          - endpoints_7:
              name: threatfeed
              initial_lookback_period: 1d
          - endpoints_8:
              name: messageholdlist
              initial_lookback_period: 1d
          - endpoints_9:
              name: messageholdsummary
              initial_lookback_period: 1d
          - endpoints_10:
              name: dashboard
              initial_lookback_period: 1d
  mimecast_siem_input:
    id: <short_unique_identifier>2
    enabled: truefalse
    requests_per_second: 5
    base_url: your_base_url
    auth_url: your_auth_url
    pageSize: 10
    autoconfig:
      refresh_interval_in_seconds: 60      # Runs the setup every x seconds (default 600)
      creation_timeout_in_second: 60        # Set up the setup timeout (default 60)
    credentials:
       app client_id: your<client_appid_idvalue>
        app_key: your_app_key
        access_key: your_access_key
        secret_key: your_secret_keyclient_secret: <client_secret_value>
    services:
      service_mimecast_siem_client_api:
        last_configuration_timestamp: 2021-12-02T13:10:00Z # change this if you want to get your state changed!
        endpoints:
          siem:
            initial_lookback_period: 1d

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Replace the placeholders with your required values following the description table below:

Parameter

Data Typetype

Type

Value Rangerange/ Format

Details

debug

bool

Mandatory

false / true

This will make the collector generate (or not) log messages with the DEBUG level.

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in Global Base URLs | Mimecast.

credentials

dictionary

Mandatory

Code Block
app client_id: your<client_app_id app_key: your_app_key access_key: your_access_key secret_key: your_secret_key

id_value>
        client_secret: <client_secret_value>

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block

- endpoints_1:
    name: audit
    initial_lookback_period: 1d
- endpoints_2:
    name: attachments
    initial_lookback_period: 1d
- endpoints_3:
    name: impersonation
    initial_lookback_period: 1d
- endpoints_4:
    name: url
    initial_lookback_period: 1d
- endpoints_5:
    name: search
    initial_lookback_period: 1d
- endpoints_6:
    name: view
    initial_lookback_period: 1d
- endpoints_7:
    name: threatfeed
    initial_lookback_period: 1d
- endpoints_8:
    name: messageholdlist
    initial_lookback_period: 1d
- endpoints_9:
    name: messageholdsummary
    initial_lookback_period: 1d
- endpoints_10:
    name: dashboard
    initial_lookback_period: 1d

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

1d

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

Download the Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run \
--name <YOUR_COLLECTOR_NAME>\
--volume $PWD/certs:/devo-collector/certs \
--volume $PWD/config:/devo-collector/config \
--volume $PWD/state:/devo-collector/state \
--env CONFIG_FILE=<YOUR-CONFIG-FILE>.yaml \
--rm -it <YOUR_DEVO_IMAGE_NAME>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the

image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-mimecast_collector-docker-image-1.2.0	`d9a494fab9f1d64cdd5776b197fb062afa1dd63d3aa99348e95d1fb01fc30e5d`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  docker run \
--name <YOUR_COLLECTOR_NAME>:
    image: <YOUR_DEVO_IMAGE_NAME>:${IMAGE_VERSION:-latest}
    volumes:
      - .\
--volume $PWD/certs:/devo-collector/certs \
     --volume .$PWD/config:/devo-collector/config \
     --volume .$PWD/state:/devo-collector/state \
   environment:
      - CONFIG_FILE=${CONFIG_FILE:---env CONFIG_FILE=<YOUR-CONFIG-FILE>.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d \ --rm -it <YOUR_DEVO_IMAGE_NAME>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

version: '3'
services:
  <YOUR_COLLECTOR_NAME>:
    image: <YOUR_DEVO_IMAGE_NAME>:${IMAGE_VERSION:-latest}
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-<YOUR-CONFIG-FILE>.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access to the domain in which you want this instance to be created in, click on Add Collector and search for “Mimecast Collector - Integrations Factory”, then click on the result.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

{
"mimecast_input": {
      "id": "<short_unique_identifier>",
      "enabled": true,
      "base_url": "your_base_url",
      "auth_url": "your_auth_url",
      "pageSize": "<page_size_value>",
      "autoconfig": {
        "initialrefresh_interval_lookbackin_periodseconds": "1drefresh_interval_value",
        "creation_timeout_in_second": "creation_timeout_value"
  }    },
      },
"credentials": {
         {"client_id": "your_client_id",
            "endpointsclient_2secret": {"your_client_secret"
       },
      "nameservices": "attachments",{
              "initial_lookback_period": "1d""service_mimecast_client_api": {
          "last_configuration_timestamp": "last_configuration_timestamp_value",
  }        "endpoints": [
 },           {
              "endpoints_31": {
                "name": "impersonationaudit",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_42": {
                "name": "urlattachments",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_53": {
                "name": "searchimpersonation",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_64": {
                "name": "viewurl",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_75": {
                "name": "threatfeedsearch",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_86": {
                "name": "messageholdlistview",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_97": {
                "name": "messageholdsummarythreatfeed",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_108": {
                "name": "dashboardmessageholdlist",
                "initial_lookback_period": "1d"
              }
            },
        ]    {
  }      }   },   "mimecastendpoints_siem_input9": {
                "idname": "<short_unique_identifier>messageholdsummary",
    "enabled": true,     "requests_per_second": 5,     "baseinitial_lookback_urlperiod": "your_base_url",1d"
     "pageSize": 10,     "autoconfig": {  }
    "refresh_interval_in_seconds": 60,         "creation_timeout_in_second": 60},
      },     "credentials": {
      "app_id": "your_app_id",       "appendpoints_key10": "your_app_key", {
        "access_key": "your_access_key",       "secret_keyname": "your_secret_keydashboard",
    },      "services": {
      "serviceinitial_mimecast_siem_client_apilookback_period": {
        "last_configuration_timestamp": "2021-12-02T13:10:00.000Z","1d"
         "endpoints": {    }
      "siem": {     }
       "initial_lookback_period": "1d"  ]
        }
      }
 }   },
   }
  "mimecast_siem_input": {
  }   }
}

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range/ Format

Details

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in https://integrations.mimecast.com/documentation/api-overview/global-base-urls/.

credentials

dictionary

Mandatory

Code Block"credentials": { "app

 "id": "<short_unique_identifier>",
      "enabled": true,
      "requests_per_second": "requests_per_second_value",
      "base_url": "your_base_url",
      "auth_url": "your_auth_url",
      "pageSize": "page_size_value",
      "autoconfig": {
        "refresh_interval_in_seconds": "refresh_interval_value",
        "creation_timeout_in_second": "creation_timeout_value"
      },
      "credentials": {
        "client_id": "your_

app

client_id",

"app_key": "your_app_key", "access_key": "your_access_key", "secret_key

        "client_secret": "your_client_secret

_key

},

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block[

},

{

  "services": {

"endpoints_1

"service_mimecast_siem_client_api": {

"name

"last_configuration_timestamp": "

audit

last_configuration_timestamp_value",

"initial_lookback_period

"endpoints":

"1d"

}

"siem": {

},

     "initial_lookback_period": "1d"

{

"endpoints_2": {

"name": "attachments",

}
      }

"initial_lookback_period": "1d" } }, { "endpoints_3": { "name": "impersonation", "initial_lookback_period": "1d" } }, { "endpoints_4": { "name": "url", "initial_lookback_period": "1d" } },

}
}

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range/ Format

Details

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in https://integrations.mimecast.com/documentation/api-overview/global-base-urls/.

credentials

dictionary

Mandatory

Code Block
"credentials": { {"client_id": "your_client_id", "endpoints_5"client_secret": "your_client_secret" },

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block

[
          {
            "endpoints_1": {
              "name": "searchaudit",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_62": {
              "name": "viewattachments",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_73": {
              "name": "threatfeedimpersonation",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_84": {
              "name": "messageholdlisturl",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_95": {
              "name": "messageholdsummarysearch",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_106": {
              "name": "dashboardview",
              "initial_lookback_period": "1d"
            }
          },
          {
    ]

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

1d

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

Image Removed

         "endpoints_7": {
              "name": "threatfeed",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_8": {
              "name": "messageholdlist",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_9": {
              "name": "messageholdsummary",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_10": {
              "name": "dashboard",
              "initial_lookback_period": "1d"
            }
          }
        ]

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

1d

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

We recommend to leave parameters not in the list with their default values.

Keep in mind that the Mimecast collector has two different inputs:

mimecast_input
mimecast_siem_input

The collector can use both inputs or just one. Each input uses different endpoints and feeds different tables in Devo. Make sure to check the credentials given to determine the inputs and endpoints to use. Using Postman is a great way to check the credentials to each input. Read more here.

Input	Endpoint	Tables
`mimecast_input`	`/api/audit/get-audit-events` `/api/ttp/attachment/get-logs` `/api/ttp/impersonation/get-logs` `/api/ttp/url/get-logs` `/api/archive/get-search-logs` `/api/archive/get-view-logs` `/api/ttp/threat-intel/get-feed` `/api/gateway/get-hold-message-list` `/api/gateway/get-hold-summary-list` `/api/account/get-dashboard-notifications`	`mail.mimecast.audit.events` `mail.mimecast.ttp.attachment` `mail.mimecast.ttp.impersonation` `mail.mimecast.ttp.url` `mail.mimecast.archive.search` `mail.mimecast.archive.messageview` `mail.mimecast.threat.feed` `mail.mimecast.message.list` `mail.mimecast.message.summary` `mail.mimecast.account.dashboard`
`mimecast_siem_input`	`/api/audit/get-siem-logs`	`mail.mimecast.siem.receipt` `mail.mimecast.siem.process` `mail.mimecast.siem.delivery` `mail.mimecast.siem.jrnl` `mail.mimecast.siem.av` `mail.mimecast.siem.iep` `mail.mimecast.siem.impersonation` `mail.mimecast.siem.spameventthread` `mail.mimecast.siem.ttp`

Versions Compared

Old Version 16

New Version 17

Key

Authentication

API Application ID & API Key

Access Key & Secret Key

Permissions

Run the collector

Structure

Run the collector

Docker Compose

Structure

Devo credentials

Editing the config.yaml file

Download the Docker

Docker Compose

image

Docker

Editing the JSON configuration

Editing the JSON configuration