Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

<any_directory> └── devo-collectors/ └── <product_name>/ ├── certs/ │ ├── chain.crt │ ├── <your_domain>.key │ └── <your_domain>.crt ├── state/
Rw ui tabs macro
Rw tab
titleOn-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block
Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

  1. In the Collector Server GUI, access to the domain in which you want this instance to be created in, click on Add Collector and search for “Mimecast Collector - Integrations Factory”, then click on the result.

  2. In the Version field, select the latest value.

  3. In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).

  4. In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block
{
"mimecast_input": {
      "id": "<short_unique_identifier>",
      "enabled": true,
      "base_url": "your_base_url",
      "auth_url": "your_auth_url",
      "pageSize":  └── config/"<page_size_value>",
      "autoconfig": {
       └── config.yaml 
Note

Replace <product_name> with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Removed
Note

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block
globals:
  debug: false
  id: not_used
  name: mimecast_collector
  persistence:
    type: filesystem
    config:
      directory_name: state
  queue_max_size_in_messages: 1000
  queue_wrap_max_size_in_messages: 100
outputs:
#  devo_1:
#    type: devo_platform
#    config:
#      address: collector-us.devo.io
#      port: 443
#      type: SSL
#      chain: chain.crt
#      cert: <devo_domain>.crt
#      key: <devo_domain>.key
#  devo_2:
#    type: devo_platform
#    config:
#      address: collector-eu.devo.io
#      port: 443
#      type: SSL
#      chain: chain.crt
#      cert: <devo_domain>.crt
#      key: <devo_domain>.key
#  relay_1:
#    type: syslog
#    config:
#      address: 172.1.1.1
#      port: 13000
#      period_sender_stats_in_seconds: 60
#      concurrent_connections: 2
  console_1:
    type: console

inputs:
  mimecast_input:
    id: 1
    enabled: true
    requests_per_second: 5
    base_url: your_base_url
    auth_url: your_auth_url
    pageSize: 1000
    autoconfig:
      refresh_interval_in_seconds: 60      # Runs the setup every x seconds (default 600)
      creation_timeout_in_second: 60 "refresh_interval_in_seconds": "refresh_interval_value",
        "creation_timeout_in_second": "creation_timeout_value"
      },
      "credentials": {
        "client_id": "your_client_id",
        "client_secret": "your_client_secret"
      },
      "services": {
        "service_mimecast_client_api": {
          "last_configuration_timestamp": "last_configuration_timestamp_value",
          "endpoints": [
            {
              "endpoints_1": {
                "name": "audit",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_2": {
                "name": "attachments",
                "initial_lookback_period": "1d"
              }
            },
            {
              "endpoints_3": {
       # Set up the setup timeout (default 60)  "name": "impersonation",
 credentials:       client_id: <client_id_value>       client_secret: <client_secret_value>"initial_lookback_period": "1d"
     services:       service_mimecast_client_api:  }
      last_configuration_timestamp: 2021-12-02T13:10:00Z # change this if you want to get your state changed!      },
            {
  endpoints:           - "endpoints_14": {
                "name": "url",
 audit               "initial_lookback_period": "1d"
          - endpoints_2:   }
           name: attachments},
            {
 initial_lookback_period: 1d           - "endpoints_35": {
                "name": impersonation"search",
               initial "initial_lookback_period": "1d"
          - endpoints_4:   }
           name: url},
            {
 initial_lookback_period: 1d           - "endpoints_56": {
                "name": "view",
search                "initial_lookback_period": "1d"
          - endpoints_6:   }
           name: view},
            {
 initial_lookback_period: 1d           - "endpoints_7": {
                "name": "threatfeed",
                "initial_lookback_period": "1d"
          - endpoints_8:   }
           name: messageholdlist},
            {
 initial_lookback_period: 1d           - "endpoints_98": {
                "name": "messageholdlist",
messageholdsummary                "initial_lookback_period": "1d"
          - endpoints_10:   }
           name: dashboard},
              initial_lookback_period: 1d{
    mimecast_siem_input:     id: 2     enabled"endpoints_9": false{
    requests_per_second: 5     base_url: your_base_url     auth_url: your_auth_url"name": "messageholdsummary",
    pageSize: 10     autoconfig:       refresh"initial_interval_in_seconds: 60lookback_period": "1d"
          # Runs the setup every}
x seconds (default 600)       creation_timeout_in_second: 60 },
      # Set up the setup timeout (default{
60)     credentials:         client"endpoints_id10": <client_id_value>{
        client_secret: <client_secret_value>     services:  "name": "dashboard",
      service_mimecast_siem_client_api:
          "initial_lookback_period": "1d"
         last_configuration_timestamp: 2021-12-02T13:10:00Z # change this if}
you want to get your state changed!      }
  endpoints:        ]
  siem:      }
      initial_lookback_period: 1d
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace the placeholders with your required values following the description table below:

Parameter

Data type

Type

Value range/ Format

Details

debug

bool

Mandatory

false / true

This will make the collector generate (or not) log messages with the DEBUG level.

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in Global Base URLs | Mimecast.

credentials

dictionary

Mandatory

Code Block
        client_id: <client_id_value>
        client_secret: <client_secret_value>

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block
- endpoints_1:
    name: audit
    initial_lookback_period: 1d
- endpoints_2:
    name: attachments
    initial_lookback_period: 1d
- endpoints_3:
    name: impersonation
    initial_lookback_period: 1d
- endpoints_4:
    name: url
    initial_lookback_period: 1d
- endpoints_5:
    name: search
    initial_lookback_period: 1d
- endpoints_6:
    name: view
    initial_lookback_period: 1d
- endpoints_7:
    name: threatfeed
    initial_lookback_period: 1d
- endpoints_8:
    name: messageholdlist
    initial_lookback_period: 1d
- endpoints_9:
    name: messageholdsummary
    initial_lookback_period: 1d
- endpoints_10:
    name: dashboard
    initial_lookback_period: 1d

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

  • 1d

 

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

 This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image

SHA-256 hash

collector-mimecast_collector-docker-image-2.0.1

c422b9205a569d5a9e7ccf510852b6d756ba97e3a46e734efeb633005482c79a

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz | docker load

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block
docker run \
--name <YOUR_COLLECTOR_NAME>\
--volume $PWD/certs:/devo-collector/certs \
--volume $PWD/config:/devo-collector/config \
--volume $PWD/state:/devo-collector/state \
--env CONFIG_FILE=<YOUR-CONFIG-FILE>.yaml \
--rm -it <YOUR_DEVO_IMAGE_NAME>:<version>
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block
version: '3'
services:
  <YOUR_COLLECTOR_NAME>:
    image: <YOUR_DEVO_IMAGE_NAME>:${IMAGE_VERSION:-latest}
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-<YOUR-CONFIG-FILE>.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Rw tab
titleCloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

  1. In the Collector Server GUI, access to the domain in which you want this instance to be created in, click on Add Collector and search for “Mimecast Collector - Integrations Factory”, then click on the result.

  2. In the Version field, select the latest value.

  3. In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).

  4. In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block
{
"mimecast_input"}
    },
    "mimecast_siem_input": {
      "id": "<short_unique_identifier>",
      "enabled": true,
      "requests_per_second": "requests_per_second_value",
      "base_url": "https://api.services.mimecast.com",
      "auth_url": "https://api.services.mimecast.com/oauth/token",
      "pageSize": "page_size_value",
      "autoconfig": {
        "refresh_interval_in_seconds": "refresh_interval_value",
        "creation_timeout_in_second": "creation_timeout_value"
      },
      "credentials": {
        "client_id": "your_client_id",
        "client_secret": "your_client_secret"
      },
      "services": {
        "service_mimecast_siem_client_api": {
          "last_configuration_timestamp": "last_configuration_timestamp_value",
          "endpoints": {
            "siem": {
              "initial_lookback_period": "1d"
            }
          }
        }
      }
    }
}
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range/ Format

Details

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in https://integrations.mimecast.com/documentation/api-overview/global-base-urls/.

credentials

dictionary

Mandatory

Code Block
"credentials": {
        "client_id": "your_client_id",
        "client_secret": "your_client_secret"
},

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block
[
          {
            "endpoints_1": {
              "name": "audit",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_2": {
              "name": "attachments",
              "initial_lookback_period": "1d"
            }
          },
          {
            "endpoints_3": {
      
"id":
 
"<short_unique_identifier>",
       "
enabled
name": 
true
"impersonation",
      
"base_url":
 
"your_base_url",
       "
auth
initial_lookback_
url
period": "
your_auth_url
1d"
,

      
"pageSize":
 
"<page_size_value>",
     
}
"autoconfig":
 
{
         
"refresh_interval_in_seconds": "refresh_interval_value"
},
        
"creation_timeout_in_second":
 
"creation_timeout_value"
 {
     
},
       "
credentials
endpoints_4": {
        
"client_id":
 
"your_client_id",
     
"client_secret
"name": "
your_client_secret" }
url",
      
"services":
 
{
       
"
service
initial_
mimecast
lookback_
client_api
period": 
{
"1d"
         
"last_configuration_timestamp": "last_configuration_timestamp_value",
   }
       
"endpoints":
 
[
  },
          {
            
"endpoints_
1
5": {
              
"name": "
audit
search",

              "initial_lookback_period": "1d"

            
}

          },

          {

            
"endpoints_
2
6": {

              "name": "
attachments
view",
              
"initial_lookback_period": "1d"
            
}

          },

          
{

            "endpoints_
3
7": {

              
"name": "
impersonation
threatfeed",
              
"initial_lookback_period": "1d"
            
}

          },
          
{
            
"endpoints_
4
8": {

              "name": "
url
messageholdlist",

              
"initial_lookback_period": "1d"

            }

          },

          
{
            
"endpoints_
5
9": {

              
"name": "
search
messageholdsummary",
              
"initial_lookback_period": "1d"

            }

          
},

          {

            "endpoints_
6
10": {

              "name": "
view
dashboard",
              
"initial_lookback_period": "1d"

            }
          
}
,

        
{ "endpoints_7": { "name": "threatfeed", "initial_lookback_period": "1d" } }, { "endpoints_8": { "name": "messageholdlist", "initial_lookback_period": "1d" } }, { "endpoints_9": { "name": "messageholdsummary", "initial_lookback_period": "1d" } }, { "endpoints_10": { "name": "dashboard", "initial_lookback_period": "1d" } } ] } } }, "mimecast_siem_input": { "id": "<short_unique_identifier>", "enabled": true, "requests_per_second": "requests_per_second_value", "base_url": "your_base_url", "auth_url": "your_auth_url", "pageSize": "page_size_value", "autoconfig": {
]

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

  • 1d

 

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

 This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

We recommend to leave parameters not in the list with their default values.

Keep in mind that the Mimecast collector has two different inputs:

  • mimecast_input

  • mimecast_siem_input

The collector can use both inputs or just one. Each input uses different endpoints and feeds different tables in Devo. Make sure to check the credentials given to determine the inputs and endpoints to use. Using Postman is a great way to check the credentials to each input. Read more here.

Input

Endpoint

Tables

mimecast_input

  • /api/audit/get-audit-events

  • /api/ttp/attachment/get-logs

  • /api/ttp/impersonation/get-logs

  • /api/ttp/url/get-logs

  • /api/archive/get-search-logs

  • /api/archive/get-view-logs

  • /api/ttp/threat-intel/get-feed

  • /api/gateway/get-hold-message-list

  • /api/gateway/get-hold-summary-list

  • /api/account/get-dashboard-notifications

  • mail.mimecast.audit.events

  • mail.mimecast.ttp.attachment

  • mail.mimecast.ttp.impersonation

  • mail.mimecast.ttp.url

  • mail.mimecast.archive.search

  • mail.mimecast.archive.messageview

  • mail.mimecast.threat.feed

  • mail.mimecast.message.list

  • mail.mimecast.message.summary

  • mail.mimecast.account.dashboard

mimecast_siem_input

  • /api/audit/get-siem-logs

  • mail.mimecast.siem.receipt

  • mail.mimecast.siem.process

  • mail.mimecast.siem.delivery

  • mail.mimecast.siem.jrnl

  • mail.mimecast.siem.av

  • mail.mimecast.siem.iep

  • mail.mimecast.siem.impersonation

  • mail.mimecast.siem.spameventthread

  • mail.mimecast.siem.ttp

Rw tab
titleOn-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block
<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml 
Note

Replace <product_name> with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Added
Note

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block
globals:
  debug: false
  id: not_used
  name: mimecast_collector
  persistence:
    type: filesystem
    config:
      directory_name: state
  queue_max_size_in_messages: 1000
  queue_wrap_max_size_in_messages: 100
outputs:
#  devo_1:
#    type: devo_platform
#    config:
#      address: collector-us.devo.io
#      port: 443
#      type: SSL
#      chain: chain.crt
#      cert: <devo_domain>.crt
#      key: <devo_domain>.key
#  devo_2:
#    type: devo_platform
#    config:
#      address: collector-eu.devo.io
#      port: 443
#      type: SSL
#      chain: chain.crt
#      cert: <devo_domain>.crt
#      key: <devo_domain>.key
#  relay_1:
#    type: syslog
#    config:
#      address: 172.1.1.1
#      port: 13000
#      period_sender_stats_in_seconds: 60
#      concurrent_connections: 2
  console_1:
    type: console

inputs:
  mimecast_input:
    id: 1
    enabled: true
    requests_per_second: 5
    base_url: https://api.services.mimecast.com
    auth_url: https://api.services.mimecast.com/oauth/token
    pageSize: 1000
    autoconfig:
      refresh_interval_in_seconds: 60      # Runs the setup every x seconds (default 600)
      creation_timeout_in_second: 60        # Set up the setup timeout (default 60)
    credentials:
      client_id: <client_id_value>
      client_secret: <client_secret_value>
    services:
      service_mimecast_client_api:
        last_configuration_timestamp: 2021-12-02T13:10:00Z # change this if you want to get your state changed!
        endpoints:
          - endpoints_1:
              name: audit
              "refreshinitial_interval_in_seconds": "refresh_interval_value",lookback_period: 1d
          - "creation_timeout_in_second": "creation_timeout_value"endpoints_2:
       },       "credentials"name: {
 attachments
      "client_id": "your_client_id",         "client_secret": "your_client_secret"initial_lookback_period: 1d
         }, - endpoints_3:
    "services": {         "service_mimecast_siem_client_api": {name: impersonation
              "lastinitial_configurationlookback_timestamp"period: "last_configuration_timestamp_value",1d
          - "endpoints"_4:
 {             "siem"name: {url
              "initial_lookback_period": "1d"
            }
     
    }      - endpoints_5:
 }       }     }
}
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range/ Format

Details

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in https://integrations.mimecast.com/documentation/api-overview/global-base-urls/.

credentials

dictionary

Mandatory

Code Block"credentials": {
 name: search
              initial_lookback_period: 1d
          - endpoints_6:
              name: view
              initial_lookback_period: 1d
          - endpoints_7:
              name: threatfeed
              initial_lookback_period: 1d
          - endpoints_8:
              name: messageholdlist
              initial_lookback_period: 1d
          - 
"client
endpoints_
id": "your_client_id",
9:
              
"client_secret": "your_client_secret" },

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block[
name: messageholdsummary
              initial_lookback_period: 1d
          - endpoints_10:
              name: 
{
dashboard
              
"endpoints_1"
initial_lookback_period: 
{
1d
  mimecast_siem_input:
    id: 2
    
"name": "audit",
enabled: false
    requests_per_second: 5
    base_url: your_base_url
    
"initial_lookback_period": "1d"
auth_url: your_auth_url
    pageSize: 10
    autoconfig:
      refresh_interval_in_seconds: 60      # 
}
Runs the setup every x seconds (default 600)
   
},
   creation_timeout_in_second: 60       
{
 # Set up the setup timeout (default 60)
    
"endpoints_2"
credentials:
{
        client_id: <client_id_value>
     
"name":
 
"attachments",
  client_secret: <client_secret_value>
    services:
      
"initial_lookback_period": "1d"
service_mimecast_siem_client_api:
        last_configuration_timestamp: 2021-12-02T13:10:00Z # change this 
}
if you want to get your state changed!
   
},
     endpoints:
     
{
     siem:
    
"endpoints_3":
 
{
       initial_lookback_period: 
"name": "impersonation", "initial_lookback_period": "1d" } }, { "endpoints_4": { "name": "url", "initial_lookback_period": "1d" } }, { "endpoints_5": { "name": "search",
1d
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace the placeholders with your required values following the description table below:

Parameter

Data type

Type

Value range/ Format

Details

debug

bool

Mandatory

false / true

This will make the collector generate (or not) log messages with the DEBUG level.

id

str

Mandatory

Minimum length: 1
Maximum length: 5

Alphanumeric identifier.

enabled

bool

Mandatory

true/false

Enables or disables the input.

base_url

str

Mandatory

The region related to the API credentials, the string value has to be one of the valid URL’s in Global Base URLs | Mimecast.

credentials

dictionary

Mandatory

Code Block
        
"initial_lookback_period": "1d"
client_id: <client_id_value>
        
} }, { "endpoints_6": {
client_secret: <client_secret_value>

Credentials to use the API.

endpoints

list

Mandatory

Minimum length: 1

Posible values:

Code Block
- endpoints_1:
    
"
name
"
: 
"view",
audit
    
"
initial_lookback_period
"
: 
"
1d
"

- endpoints_2:
    name: attachments
    
}
initial_lookback_period: 1d
- endpoints_3:
    name: impersonation
 
},
   initial_lookback_period: 1d
{
- endpoints_4:
    name: url
    initial_lookback_period: 1d
- 
"
endpoints_
7"
5:
{
    name: search
    initial_lookback_period: 1d
"name"
- endpoints_6:
"threatfeed",
    
name: view
    
"
initial_lookback_period
"
: 
"
1d
"

- endpoints_7:
    name: threatfeed
    
}
initial_lookback_period: 1d
- endpoints_8:
    name: messageholdlist
 
},
   initial_lookback_period: 1d
- endpoints_9:
 
{
   name: messageholdsummary
    initial_lookback_period: 1d
- 
"
endpoints_
8"
10:
{
    name: dashboard
    initial_lookback_period: 
"name": "messageholdlist", "initial_lookback_period": "1d" } }, { "endpoints_9": { "name": "messageholdsummary", "initial_lookback_period": "1d" } }, { "endpoints_10": { "name": "dashboard", "initial_lookback_period": "1d" } } ]

An array with at least one endpoint, the collector will pull from the selected endpoints.

last_configuration_timestamp

str

Mandatory

Date following the next format:

yyyy-mm-ddThh:mm:ss.000Z

Change this value to a date after the initial configuration to reset the state of the collector.

initial_lookback_period

str

Mandatory

Number of days, Example:

  • 1d

 

This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

 This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

We recommend to leave parameters not in the list with their default values.

Keep in mind that the Mimecast collector has two different inputs:

  • mimecast_input

  • mimecast_siem_input

The collector can use both inputs or just one. Each input uses different endpoints and feeds different tables in Devo. Make sure to check the credentials given to determine the inputs and endpoints to use. Using Postman is a great way to check the credentials to each input. Read more here.

Input

Endpoint

Tables

mimecast_input

  • /api/audit/get-audit-events

  • /api/ttp/attachment/get-logs

  • /api/ttp/impersonation/get-logs

  • /api/ttp/url/get-logs

  • /api/archive/get-search-logs

  • /api/archive/get-view-logs

  • /api/ttp/threat-intel/get-feed

  • /api/gateway/get-hold-message-list

  • /api/gateway/get-hold-summary-list

  • /api/account/get-dashboard-notifications

  • mail.mimecast.audit.events

  • mail.mimecast.ttp.attachment

  • mail.mimecast.ttp.impersonation

  • mail.mimecast.ttp.url

  • mail.mimecast.archive.search

  • mail.mimecast.archive.messageview

  • mail.mimecast.threat.feed

  • mail.mimecast.message.list

  • mail.mimecast.message.summary

  • mail.mimecast.account.dashboard

mimecast_siem_input

  • /api/audit/get-siem-logs

  • mail.mimecast.siem.receipt

  • mail.mimecast.siem.process

  • mail.mimecast.siem.delivery

  • mail.mimecast.siem.jrnl

  • mail.mimecast.siem.av

  • mail.mimecast.siem.iep

  • mail.mimecast.siem.impersonation

  • mail.mimecast.siem.spameventthread

  • mail.mimecast.siem.ttp
    1d
    

    An array with at least one endpoint, the collector will pull from the selected endpoints.

    last_configuration_timestamp

    str

    Mandatory

    Date following the next format:

    yyyy-mm-ddThh:mm:ss.000Z

    Change this value to a date after the initial configuration to reset the state of the collector.

    initial_lookback_period

    str

    Mandatory

    Number of days, Example:

    • 1d

     

    This value will be subtracted from the current date to execute all queries in that range if no state is detected (Initial execution for example).

     This value only has an effect for mimecast_input, mimecast_siem_input always pull from the last 7 days.

    Download the Docker image

    The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

    Collector Docker image

    SHA-256 hash

    collector-mimecast_collector-docker-image-2.0.1

    c422b9205a569d5a9e7ccf510852b6d756ba97e3a46e734efeb633005482c79a

    Use the following command to add the Docker image to the system:

    Code Block
    gunzip -c <image_file>-<version>.tgz | docker load

    Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

    The Docker image can be deployed on the following services:

    Docker

    Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

    Code Block
    docker run \
    --name <YOUR_COLLECTOR_NAME>\
    --volume $PWD/certs:/devo-collector/certs \
    --volume $PWD/config:/devo-collector/config \
    --volume $PWD/state:/devo-collector/state \
    --env CONFIG_FILE=<YOUR-CONFIG-FILE>.yaml \
    --rm -it <YOUR_DEVO_IMAGE_NAME>:<version>
    Note

    Replace <product_name>, <image_name> and <version> with the proper values.

    Docker Compose

    The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

    Code Block
    version: '3'
    services:
      <YOUR_COLLECTOR_NAME>:
        image: <YOUR_DEVO_IMAGE_NAME>:${IMAGE_VERSION:-latest}
        volumes:
          - ./certs:/devo-collector/certs
          - ./config:/devo-collector/config
          - ./state:/devo-collector/state
        environment:
          - CONFIG_FILE=${CONFIG_FILE:-<YOUR-CONFIG-FILE>.yaml}

    To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

    Code Block
    IMAGE_VERSION=<version> docker-compose up -d
    Note

    Replace <product_name>, <image_name> and <version> with the proper values.

    Change log

    Release

    Released on

    Release type

    Details

    Recommendations

     v2.0.1

    Status
    colourYellow
    titleIMPROVEMENTS

    -

    Recommended version

     v1.2.0

    Status
    colourYellow
    titleIMPROVEMENTS

    Improvements

    • Upgraded the mimecast api from v1 to v2.

    • Updated DCSDK from 1.10.2 to 1.11.1

    -