Mimecast Event Collector Deprecated

Deprecated. Use Mimecast Event Collector v2 instead.

Email · Mimecast

Details

IDMimecast Event Collector
ProviderPermira
CategoryEmail
From Version6.8.0
Docker Imagedemisto/py3-tools:1.0.0.114656
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Note: This integration is deprecated following the announcement about Mimecast API 1.0 End of Life. Use Mimecast Event Collector v2 instead.

Configure Mimecast Event Collector in Cortex

Parameter Description Required
Base URL   True
Application ID   True
Application Key   True
Access Key   True
Secret Key   True
First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) This parameter is used only for the Audit logs configuration. SIEM logs always set to “7 days ago”. For additional information, review the pack README. True
Trust any certificate (not secure)   False
Use system proxy settings   False

General information

This integration is collecting events from 2 end points.

  • audit events

    All events are fetched at once when activating the integration from first fetch timestamp until now.
    After that the fetch mechanism will call every 1 minute to update the audit events from Mimecast.

  • SIEM logs

    The logs will always be fetched from 7 days ago. Once the integration is activated, the logs will
    stream in batches of 350 logs per fetch.
    When all available logs are retrieved, the fetch mechanism will call every 1 minute to update the SIEM logs from Mimecast.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

mimecast-get-events

Manual command to fetch events and display them.

Base Command

mimecast-get-events

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. Required

Context Output

There is no context output for this command.

Configuration parameters

  • base_url — Base URL (required)
  • credentials_app — Application ID (required)
  • credentials_access_key — (required)
  • credentials_secret_key — (required)
  • after — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • mimecast-get-events

    Manual command to fetch events and display them.

Source

MimecastEventCollector.py MimecastEventCollector_test.py MimecastEventCollector.yml MimecastEventCollector_description.md command_examples.txt
Download History Raw 
## Mimecast Event Collector  

In order to retrieve your Mimecast credentials for Cortex XSIAM, follow the instructions below. 

### Application ID and Application Key 
Perform the following steps in your Mimecast application:  

1. Go to **Administration console** -> **Administration** -> **Services** -> 
**API and Platform Integrations** -> Your Application Integrations.  
2. If you already have an application, 
click the 3-dot menu and click **View** to retrieve your application ID and    
application key.   
   Otherwise, click **Add API Application** and follow the instructions.   
  
### Secret Key and Access Key 

1. Go to **Administration console** -> **Administration** -> **Services** -> 
**API and Platform Integrations** -> Your Application Integrations.  
2. Click the 3-dot menu and click **Create Keys** and
follow the steps to retrieve your Access Key and Secret Key

*Note: You may have to wait up to 20 minutes after creation of a new API Application.*
  
  
### Base URL 

Insert your custom base URL or checkout 
[Mimecast base url](https://integrations.mimecast.com/documentation/api-overview/global-base-urls/)
in order to find your base URL (for example: https://us-api.mimecast.com).

### Pre-requisites

##### Audit Logs 
[Audit pre-requisites](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-audit-events/#:~:text=Sample%20Code-,Pre,-%2Drequisites)

##### SIEM Logs
[SIEM pre-requisites](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-siem-logs/#description:~:text=in%20logs%27%20downloaded.-,Pre%2Drequisites,-The%20data%20served)