Overview

Mimecast is a cloud-based, anti-spam, and archive filtering service for securing email accounts and communications for businesses.

Mimecast protects an enterprise’s email infrastructure from viruses, malware, phishing, and the rise of deep-fake attacks. It does this by deploying a layered cyber resilience solution that prevents email-borne infections and reduces data loss by archiving emails. This cloud-based cybersecurity solution also makes it possible to automate the recovery of archived and affected emails for continuous use.

The Mimecast approach to protecting email structures means it can predict or anticipate attacks in order to handle real-time threats. It also deals with data loss from ransomware attacks using data archiving, which eliminates the need to meet ransom demands, as well as struggle with downtime. Mimecast can also be deployed to tackle those annoyingly ‘spammy’ messages that keep cluttering inboxes.

For those who already use any of the popular email management brands such as Microsoft Office 365, Outlook, or Google’s Gsuite, Mimecast’s cloud-based nature makes it compatible with them. It can be deployed to tackle spam, ransomware, or other cybersecurity challenges.

The Devo Mimecast Collector uses the Mimecast API to extract all the relevant information an send it as events to Devo.

Data sources

For more information on how the events are parsed, visit our page.

Vendor setup

Permissions (both API 1 and 2)

Each API call has a prerequisite section that tells you what permissions are needed for the call. Usually, a Basic Administrator role will suffice, which should allow you to use the same API keys generated for multiple API calls under the application.  

If you want to create a custom administrative role for this API service account user: 

1. Navigate to Administration | Account | Roles. 

2. Click New Role.

3. Enter a Role Name and Description.

4. In the Application Permissions section, select the boxes for each required role to be used by the service user account. 

5. Click Save and Exit. 

6. Locate the newly created role and click on the role name. 

7. Click Add User to Role. 

8. Click on the email address of the API service user account. 

If you want to add the service account user to an existing role:

1. Navigate to Administration | Account | Roles. 

2. Click on the administrator role the user will be added to. 

3. Click Add User to Role.

4. Click on the email address of the API service user account.

More details https://community.mimecast.com/s/article/Managing-API-Applications-505230018#Creating-an-API-user-Authentication-Profile .

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

API limits and duplicates

The Mimecast API has some call rate limits. When a limit is reached, the collector shows a 429 error. More details about MImecast limits can be found here and here

The Mimecast API sometimes sends duplicate events (it is not common). The collector tries to filter out the duplicates, but it is not possible to guarantee that all duplicates are deleted.

Change log