mail.mimecast

Introduction

The tags beginning with mail.mimecast identify events generated by Mimecast.

Valid tags and data tables

The full tag must have 4 levels. The first two are fixed as mail.mimecast. The third level identifies the type of events sent, and the fourth level indicates the event subtype

Technology	Brand	Type	Subtype
mail	mimecast	archive audit siem ttp message threat account	messageview search events delivery jrnl process receipt attachment impersonation url liost summary feed dashboard

These are the valid tags and corresponding data tables that will receive the parsers' data:

Tag	Data table
mail.mimecast.archive.messageview	mail.mimecast.archive.messageview
mail.mimecast.archive.search	mail.mimecast.archive.search
mail.mimecast.audit.events	mail.mimecast.audit.events
mail.mimecast.siem.delivery	mail.mimecast.siem.delivery
mail.mimecast.siem.jrnl	mail.mimecast.siem.jrnl
mail.mimecast.siem.process	mail.mimecast.siem.process
mail.mimecast.siem.receipt	mail.mimecast.siem.receipt
mail.mimecast.ttp.attachment	mail.mimecast.ttp.attachment
mail.mimecast.ttp.impersonation	mail.mimecast.ttp.impersonation
mail.mimecast.ttp.url	mail.mimecast.ttp.url
mail.mimecast.message.list	mail.mimecast.message.list
mail.mimecast.message.summary	mail.mimecast.message.summary
mail.mimecast.threat.feed	mail.mimecast.threat.feed
mail.mimecast.account.dashboard	mail.mimecast.account.dashboard

How is the data sent to Devo?

Events may be sent directly to Devo using the Mimecast API or using our Devo relay.