Mimecast Event Collector

Details

ID	`Mimecast Event Collector`
Provider	Permira
Category	Email
From Version	6.8.0
Docker Image	`demisto/py3-tools:1.0.0.114656`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Note: This integration is deprecated following the announcement about Mimecast API 1.0 End of Life. Use Mimecast Event Collector v2 instead.

Configure Mimecast Event Collector in Cortex

Parameter	Description	Required
Base URL		True
Application ID		True
Application Key		True
Access Key		True
Secret Key		True
First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)	This parameter is used only for the Audit logs configuration. SIEM logs always set to “7 days ago”. For additional information, review the pack README.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

General information

This integration is collecting events from 2 end points.

audit events

All events are fetched at once when activating the integration from first fetch timestamp until now.
After that the fetch mechanism will call every 1 minute to update the audit events from Mimecast.
SIEM logs

The logs will always be fetched from 7 days ago. Once the integration is activated, the logs will
stream in batches of 350 logs per fetch.
When all available logs are retrieved, the fetch mechanism will call every 1 minute to update the SIEM logs from Mimecast.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

mimecast-get-events

Manual command to fetch events and display them.

Base Command

mimecast-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

base_url — Base URL (required)
credentials_app — Application ID (required)
credentials_access_key — (required)
credentials_secret_key — (required)
after — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

mimecast-get-events
Manual command to fetch events and display them.

Source

MimecastEventCollector.py MimecastEventCollector_test.py MimecastEventCollector.yml MimecastEventCollector_description.md command_examples.txt

Download History Raw

category: Email
deprecated: true
provider: Permira
commonfields:
  id: Mimecast Event Collector
  version: -1
configuration:
- display: Base URL
  name: base_url
  required: true
  type: 0
- display: Application ID
  displaypassword: Application key
  name: credentials_app
  type: 9
  required: true
- displaypassword: Access Key
  name: credentials_access_key
  type: 9
  required: true
  hiddenusername: true
- displaypassword: Secret Key
  name: credentials_secret_key
  type: 9
  required: true
  hiddenusername: true
- display: First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)
  name: after
  additionalinfo: This parameter is used only for the Audit logs configuration. SIEM logs are always set to "7 days ago". For additional information, review the pack README.
  type: 0
  required: true
  defaultvalue: 7 days
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. Use Mimecast Event Collector v2 instead.
display: Mimecast Event Collector (Deprecated)
name: Mimecast Event Collector
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    description: Manual command to fetch events and display them.
    name: mimecast-get-events
  dockerimage: demisto/py3-tools:1.0.0.114656
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests
supportedModules:
- xsiam

Mimecast Event Collector Deprecated