MimecastV2

Use the Mimecast integration to manage email security, continuity, and archiving services.

Email · Mimecast

Details

IDMimecastV2
ProviderPermira
CategoryEmail
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.12042988
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the Mimecast integration to manage email security, continuity, and archiving services.

Rate Limiting

https://developer.services.mimecast.com/api-overview#rate-limiting
Mimecast uses quotas per period of time (i.e. rate limits) that apply to every API function, per registered App. A typical quota is a number of API calls per unit of time (but could also be expressed as the size of data returned, etc.). When the quota has been exhausted, further requests will fail until the new time period restarts the count of API calls. The rate limit reset value is the length of time in milliseconds before a minimum of 1 API will be permitted.

Configure Mimecast v2 in Cortex

Parameter Required
BaseUrl - API url including region, For example https://api.services.mimecast.com True
Client ID False
Client Secret False
App ID False
User Email Address (Use for auto token refresh) False
Password False
App key False
AccessKey False
SecretKey False
Trust any certificate (not secure) False
Use system proxy settings False
Fetch incidents False
Fetch URL incidents False
Fetch attachment incidents False
Fetch impersonation incidents False
Incident type False
Hours before first fetch to retrieve incidents False
Incident type False
Fetch incidents False
Incident type False
Fetch incidents False
Incident type False
Fetch incidents False
Incidents Fetch Interval False

Note: The fields User Email Address (Use for auto token refresh) and Password are not mandatory fields. You will only need them if you have expiry set on the auth of the user account you use to create the API keys. They will be used to auto refresh the API key once it expires.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you
successfully execute a command, a DBot message appears in the War Room with the command details.

mimecast-query

Query Mimecast emails. This is an archive search command.

Prerequisite

In order to successfully use this endpoint to search across a customer’s entire archive, the role assigned to the app must have at least the following level of application permissions granted: Archive | Search | Read.
To use this endpoint to search for messages for the logged in user or an address that the logged in user has delegate permission to, no administrator permissions are required.

Required Permissions

Archive Search Read

Base Command

mimecast-query

Input

Argument Name Description Required
queryXml The query string xml for the search using Mimecast Unified Search Experience (MUSE) - read more on https://community.mimecast.com/docs/DOC-2262, using this will override other query arguments. Optional
text Search for this text in messages. Optional
dryRun Will not execute the query, but just return the query string built. Possible values are: true, false. Default is false. Optional
date Search in specific dates only. Possible values are: today, yesterday, last_week, last_month, last_year. Optional
dateFrom Search emails from date, format YYYY-MM-DDTHH:MM:SZ (e.g. 2015-09-21T23:00:00Z). Optional
dateTo Search emails to date, format YYYY-MM-DDTHH:MM:SZ (e.g. 2015-09-21T23:00:00Z). Optional
sentTo Filter on messages to a specific address. Optional
sentFrom Filter on messages from a specific address. Optional
subject Search email by subject, will override the text argument. Optional
attachmentType These are the attachment types available: optional - messages with and without attachments any - messages with any attachment documents - messages with doc, dot, docx, docm, dotx, dotm, pdf, rtf, html attachments spreadsheets - messages with xls, xlt, xlsx, xlsm, xltx, xltm, xlsb, xlam, csv attachments presentations - messages with ppt, pptx, pptm, potx, potm, ppam, ppsx, ppsm, sldx, sldm, thms, pps attachments text - messages with txt, text, html, log attachments images - messages with jpg, jpeg, png, bmp, gif, psd, tif, tiff attachments media - messages with mp3, mp4, m4a, mpg, mpeg, avi, wav, aac, wma, mov attachments zips - messages with zip, rar, cab, gz, gzip, 7z attachments none - No attachments are to be present in the results. Possible values are: optional, any, documents, spreadsheets, presentations, text, images, media, zips, none. Optional
attachmentText Search for text in attachments. Optional
body Search email by text in body, will override the text and subject arguments. Optional
page_size Number of results per page to display. Possible values are: . Optional
startRow This parameter is ignored, use the pagination parameters instead. Possible values are: . Optional
active Defines if the search should query recently received messages that are not fully processed yet (default false). You can search by mailbox and date time across active messages. Possible values are: true, false. Default is false. Optional
limit The maximum number of results to return. Possible values are: . Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.Message.ID string Message ID
Mimecast.Message.Subject string Message subject
Mimecast.Message.Sender string Message sender address
Mimecast.Message.Recipient string Message recipient address
Mimecast.Message.RecievedDate date Message received date
Mimecast.Message.Size number The size of the message in bytes
Mimecast.Message.AttachmentCount number Message attachments count
Mimecast.Message.Status string Message status

mimecast-list-blocked-sender-policies

Deprecate - use mimecast-list-policies instead

Base Command

mimecast-list-blocked-sender-policies

Input

| Argument Name | Description | Required |
|——————-|—————–|————–|

Context Output

Path Type Description
Mimecast.Policy.ID string Policy ID
Mimecast.Policy.Sender.Address string Block Sender by email address
Mimecast.Policy.Sender.Domain string Block Sender by domain
Mimecast.Policy.Sender.Group string Block Sender by group
Mimecast.Policy.Bidirectional boolean Blocked policy is bidirectional or not
Mimecast.Policy.Receiver.Address string Block emails to receiver type address
Mimecast.Policy.Receiver.Domain string Block emails to receiver type domain
Mimecast.Policy.Receiver.Group string Block emails to receiver type group
Mimecast.Policy.FromDate date Policy validation start date
Mimecast.Policy.ToDate date Policy expiration date
Mimecast.Policy.Sender.Type string Block emails to sender type
Mimecast.Policy.Receiver.Type string Block emails to receiver type

mimecast-get-policy

Get a policy by ID.

Base Command

mimecast-get-policy

Input

Argument Name Description Required
policyID Policy ID. The policy ID can be retrieved from the data.id field using the mimecast-list-policies command. For type address-alteration provide the folderId from the data.addressAlterationSetId field. Required
policyType Policy type. Possible values are: blockedsenders, antispoofing-bypass, address-alteration. Default is blockedsenders. Optional

Context Output

Path Type Description
Mimecast.BlockedSendersPolicy.id String The unique identifier of the blocked senders policy.
Mimecast.BlockedSendersPolicy.description String The description of the blocked senders policy.
Mimecast.BlockedSendersPolicy.from.type String The sender address type considered by the policy.
Mimecast.BlockedSendersPolicy.from.emailAddress String The sender email address considered by the policy.
Mimecast.BlockedSendersPolicy.from.domain String The sender domain considered by the policy.
Mimecast.BlockedSendersPolicy.from.groupId String The sender profile group ID considered by the policy.
Mimecast.BlockedSendersPolicy.to.type String The recipient address type considered by the policy.
Mimecast.BlockedSendersPolicy.to.emailAddress String The recipient email address considered by the policy.
Mimecast.BlockedSendersPolicy.to.domain String The recipient domain considered by the policy.
Mimecast.BlockedSendersPolicy.to.groupId String The recipient profile group ID considered by the policy.
Mimecast.BlockedSendersPolicy.bidirectional Boolean Whether the policy also applies in reverse email flow.
Mimecast.BlockedSendersPolicy.fromDateTime Date The date and time the policy starts to apply.
Mimecast.BlockedSendersPolicy.toDateTime Date The date and time the policy ceases to apply.
Mimecast.BlockedSendersPolicy.fromEternal Boolean Whether the policy applies regardless of the start date.
Mimecast.BlockedSendersPolicy.toEternal Boolean Whether the policy applies regardless of the end date.
Mimecast.BlockedSendersPolicy.fromPart String The sender address type considered, based on the envelope, header, or either address.
Mimecast.BlockedSendersPolicy.enabled Boolean Whether the policy is enabled.
Mimecast.BlockedSendersPolicy.enforced Boolean Whether the policy is enforced.
Mimecast.BlockedSendersPolicy.override Boolean Whether the policy is considered prior to other policies of the same type.
Mimecast.AntispoofingBypassPolicy.ID string Policy ID.
Mimecast.AntispoofingBypassPolicy.Sender.Address string Block Sender by email address.
Mimecast.AntispoofingBypassPolicy.Sender.Domain string Block Sender by domain.
Mimecast.AntispoofingBypassPolicy.Sender.Group string Block Sender by group.
Mimecast.AntispoofingBypassPolicy.Bidirectional boolean Blocked policy is bidirectional or not.
Mimecast.AntispoofingBypassPolicy.Receiver.Address string Block emails to receiver type address.
Mimecast.AntispoofingBypassPolicy.Receiver.Domain string Block emails to receiver type domain.
Mimecast.AntispoofingBypassPolicy.Receiver.Group string Block emails to receiver type group.
Mimecast.AntispoofingBypassPolicy.Fromdate date Policy validation start date.
Mimecast.AntispoofingBypassPolicy.Todate date Policy expiration date.
Mimecast.AddressAlterationPolicy.ID string Policy ID.
Mimecast.AddressAlterationPolicy.Sender.Address string Block Sender by email address.
Mimecast.AddressAlterationPolicy.Sender.Domain string Block Sender by domain.
Mimecast.AddressAlterationPolicy.Sender.Group string Block Sender by group.
Mimecast.AddressAlterationPolicy.Bidirectional boolean Blocked policy is bidirectional or not.
Mimecast.AddressAlterationPolicy.Receiver.Address string Block emails to receiver type address.
Mimecast.AddressAlterationPolicy.Receiver.Domain string Block emails to receiver type domain.
Mimecast.AddressAlterationPolicy.Receiver.Group string Block emails to receiver type group.
Mimecast.AddressAlterationPolicy.Fromdate date Policy validation start date.
Mimecast.AddressAlterationPolicy.Todate date Policy expiration date.

Command example

!mimecast-get-policy policyType="address-alteration" policyID=eNoVjr0OgjAYAN-lKw5QoAqJQ5H4AwZQUBM2hKJV5IutFcX47uJ8yd19kGSlEoxXyEXqLNMl8frQfnVci4Mrk8XFwunCq09G3h5MvVknETV4crYK_6htaTaZZw7gFXO4jTecxHcVBTYmmh4WqnprPQ1Fv4jpdkxMv4Z83wDsu3QGUzRCpZIPuDFRQsWG-myXUkPHFJtkgE8mJIcWucYI1dBUTPwXiWUN9u8P87s5UQ

Context Example

{
    "Mimecast": {
        "AddressAlterationPolicy": {
            "Bidirectional": null,
            "FromDate": null,
            "ID": "eNoVzs2OgjAUQOF3uVtY0IKdkcRFxfiHgwqIhh3S4tRU70wrGjS--zD7k5zvBVbWrZFKQAiHMrrbtMvPQUy_dLSaJx0lC5rNxs2JlNe97-nVJuFEbb6DanJ0Up5_TvMh0oUcqgHdKrb-bZPlgDLHi6tWdM6Tx-Y5W_P0g_mTBstCIxaPLMIRuKBF9QNhU2krXahbe8OLNDUK2VOiXcaJRzn1WV_epbEKrxASFxrUQpp_LwuCfvX-A6m-PQc",
            "Reciever": {
                "Address": null,
                "Domain": null,
                "Group": null,
                "Type": null
            },
            "Sender": {
                "Address": null,
                "Domain": null,
                "Group": null,
                "Type": null
            },
            "ToDate": null
        },
        "Policy": {
            "Bidirectional": null,
            "FromDate": null,
            "ID": "eNoVzs2OgjAUQOF3uVtY0IKdkcRFxfiHgwqIhh3S4tRU70wrGjS--zD7k5zvBVbWrZFKQAiHMrrbtMvPQUy_dLSaJx0lC5rNxs2JlNe97-nVJuFEbb6DanJ0Up5_TvMh0oUcqgHdKrb-bZPlgDLHi6tWdM6Tx-Y5W_P0g_mTBstCIxaPLMIRuKBF9QNhU2krXahbe8OLNDUK2VOiXcaJRzn1WV_epbEKrxASFxrUQpp_LwuCfvX-A6m-PQc",
            "Reciever": {
                "Address": null,
                "Domain": null,
                "Group": null,
                "Type": null
            },
            "Sender": {
                "Address": null,
                "Domain": null,
                "Group": null,
                "Type": null
            },
            "ToDate": null
        }
    }
}

Human Readable Output

Mimecast Get address-alteration Policy

Policy ID Sender Reciever Bidirectional Start End
eNoVzs2OgjAUQOF3uVtY0IKdkcRFxfiHgwqIhh3S4tRU70wrGjS–zD7k5zvBVbWrZFKQAiHMrrbtMvPQUy_dLSaJx0lC5rNxs2JlNe97-nVJuFEbb6DanJ0Up5_TvMh0oUcqgHdKrb-bZPlgDLHi6tWdM6Tx-Y5W_P0g_mTBstCIxaPLMIRuKBF9QNhU2krXahbe8OLNDUK2VOiXcaJRzn1WV_epbEKrxASFxrUQpp_LwuCfvX-A6m-PQc Group: null
Email Address: null
Domain: null
Type: null		 Group: null
Email Address: null
Domain: null
Type: null		      

mimecast-create-policy

Deprecated. Please use mimecast-create-block-sender-policy

Base Command

mimecast-create-policy

Input

Argument Name Description Required
description Policy description. Required
fromPart Addresses based on. Possible values are: envelope_from, header_from, both. Default is envelope_from. Optional
fromType Blocked Sender type. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, individual_email_address. Required
fromValue Required if fromType is one of email domain, profile group, individual email address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address. Optional
toType The receiver type. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address, free_mail_domains, header_display_name. Required
toValue Required if fromType is one of email domain, profile group, individual email address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. Optional
option The block option, must be one of: no_action, block_sender. Possible values are: no_action, block_sender. Required

Context Output

Path Type Description
Mimecast.Policy.ID string Policy ID
Mimecast.Policy.Sender.Address string Block Sender by email address
Mimecast.Policy.Sender.Domain string Block Sender by domain
Mimecast.Policy.Sender.Group string Block Sender by group
Mimecast.Policy.Bidirectional boolean Blocked policy is Bidirectional or not
Mimecast.Policy.Receiver.Address string Block emails to receiver type address
Mimecast.Policy.Receiver.Domain string Block emails to receiver type domain
Mimecast.Policy.Receiver.Group string Block emails to receiver type group
Mimecast.Policy.Fromdate date Policy validation start date
Mimecast.Policy.Todate date Policy expiration date
Mimecast.Policy.Sender.Type String The sender type
Mimecast.Policy.Receiver.Type String The receiver type

mimecast-delete-policy

Deletes a policy by ID.

Base Command

mimecast-delete-policy

Input

Argument Name Description Required
policyID Policy ID. The policy ID can be retrieved from the data.id field using the mimecast-list-policies command. Required
policyType The type of policy to delete. Possible values are: antispoofing-bypass, address-alteration, blockedsenders. Default is blockedsenders. Optional

Context Output

Path Type Description
Mimecast.Policy.ID string Policy ID.
Mimecast.BlockedSendersPolicy.ID string Policy ID.
Mimecast.AntispoofingBypassPolicy.ID string Policy ID.
Mimecast.AddressAlterationPolicy.ID string Policy ID.

mimecast-manage-sender

Permit or block a specific sender

Required Permissions

Gateway Managed Senders Edit

Base Command

mimecast-manage-sender

Input

Argument Name Description Required
sender The email address of sender to permit or block. Required
recipient The email address of recipient to permit or block. Required
action Choose to either “permit” (to bypass spam checks) or “block” (to reject the email). Possible values are: permit, block. Required
limit The maximum number of results to return. Possible values are: . Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Possible values are: . Optional
page_size Number of results per page to display. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.Managed.Sender string The email address of the sender
Mimecast.Managed.Recipient string The email address of the recipient
Mimecast.Managed.Action string Chosen action
Mimecast.Managed.ID string The Mimecast secure ID of the managed sender object.

mimecast-list-managed-url

Get a list of all managed URLs

Required Permissions

Services Targeted Threat Protection - URL Protect Edit

Base Command

mimecast-list-managed-url

Input

Argument Name Description Required
url Filter results by specific URL. Optional

Context Output

Path Type Description
Mimecast.URL.Domain string The managed domain
Mimecast.URL.Disablelogclick boolean If logging of user clicks on the URL is disabled
Mimecast.URL.Action string Either block of permit
Mimecast.URL.Path string The path of the managed URL
Mimecast.URL.matchType string Either explicit - applies to the full URL or domain - applies to all URL values in the domain
Mimecast.URL.ID string The Mimecast secure ID of the managed URL
Mimecast.URL.disableRewrite boolean If rewriting of this URL in emails is disabled

mimecast-create-managed-url

Create a managed URL on Mimecast

Required Permissions

Services Targeted Threat Protection - URL Protect Edit

Base Command

mimecast-create-managed-url

Input

Argument Name Description Required
url The URL to block or permit. Do not include a fragment (#). Required
action Set to “block” to block list the URL, “permit” to add to allow list. Possible values are: block, permit. Required
matchType Set to “explicit” to block or permit only instances of the full URL. Set to “domain” to block or permit any URL with the same domain. Possible values are: explicit, domain. Default is explicit. Optional
disableRewrite Disable rewriting of this URL in emails. Applies only if action = “permit”. Default false. Possible values are: true, false. Default is false. Optional
comment Add a comment about the managed URL. Optional
disableUserAwareness Disable User Awareness challenges for this URL. Applies only if action = “permit”. Default false. Possible values are: true, false. Default is false. Optional
disableLogClick Disable logging of user clicks on the URL. Default is false. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
Mimecast.URL.Domain string The managed domain
Mimecast.URL.Action string Either block of permit
Mimecast.URL.disableLogClick string If logging of user clicks on the URL is disabled
Mimecast.URL.matchType string Either explicit - applies to the full URL or domain - applies to all URL values in the domain
Mimecast.URL.ID string The Mimecast secure ID of the managed URL
Mimecast.URL.disableRewrite boolean If rewriting of this URL in emails is disabled

mimecast-list-messages

Get a list of messages for a given user. This is an archive search command. Required Permissions The following permissions
are required for this command.

  • Mimecast administrator with at least one of the following permissions: Archive/Search/Read.
  • or Mimecast user with delegate permissions to address or user.

Required Permissions

Archive Search Read

Base Command

mimecast-list-messages

Input

Argument Name Description Required
mailbox The email address to return the message list for Optional
startTime The start date of messages to return, in the following format, 2015-11-16T14:49:18+0000. Default is the last calendar month Optional
endTime The end date of messages to return, in the following format, 2015-11-16T14:49:18+0000. Default is the end of the current day Optional
view The message list type, must be one of: inbox or sent, default is inbox Optional
subject Filter by message subject Optional
limit The maximum number of results to return. Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Optional
page_size Number of results per page to display. Optional

Context Output

Path Type Description
Mimecast.Message.Subject string Message Subject
Mimecast.Message.ID string Message ID
Mimecast.Message.Size number The size of the message in bytes
Mimecast.Message.RecievedDate date The date the message was received
Mimecast.Message.From string The mail Sender
Mimecast.Message.AttachmentCount string The number of attachments on the message

mimecast-get-attachment-logs

Returns Attachment Protect logs for a Mimecast customer account

Required Permissions

Monitoring Attachment Protection Read

Base Command

mimecast-get-attachment-logs

Input

Argument Name Description Required
resultsNumber This parameter is ignored, use the ‘limit’ parameter instead. Possible values are: . Optional
fromDate Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day. Optional
toDate End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request. Optional
resultType Filters logs by scan result, default is malicious. Possible values are: safe, malicious, timeout, error, unsafe, all. Default is malicious. Optional
limit The maximum number of results to return. Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Optional
page_size Number of results per page to display. Optional

Context Output

Path Type Description
Mimecast.AttachmentLog.Result string The result of the attachment analysis: clean, malicious, unknown, or timeout
Mimecast.AttachmentLog.Date date The time at which the attachment was released from the sandbox
Mimecast.AttachmentLog.Sender string The sender of the attachment
Mimecast.AttachmentLog.FileName string The file name of the original attachment
Mimecast.AttachmentLog.Action string The action triggered for the attachment
Mimecast.AttachmentLog.Recipient string The address of the user that received the attachment
Mimecast.AttachmentLog.FileType string The file type of the attachment
Mimecast.AttachmentLog.Route string The route of the original email containing the attachment, either: inbound, outbound, internal, or external

mimecast-get-url-logs

Returns URL protect logs for a Mimecast customer account. Default value of scanResult as malicious

Required Permissions

Monitoring URL Protection Read

Base Command

mimecast-get-url-logs

Input

Argument Name Description Required
resultsNumber The number of results to request. Default is all Optional
fromDate Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day. Optional
toDate End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request. Optional
resultType Filters logs by scan result, default is all Optional
limit The maximum number of results to return. Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Optional
page_size Number of results per page to display. Optional

Context Output

Path Type Description
Mimecast.UrlLog.Category string The category of the URL clicked
Mimecast.UrlLog.UserAddress string The email address of the user who clicked the link
Mimecast.UrlLog.URL string The url clicked
Mimecast.UrlLog.Awareness string The action taken by the user if user awareness was applied
Mimecast.UrlLog.AdminOverride string The action defined by the administrator for the URL
Mimecast.UrlLog.Date date The date that the URL was clicked
Mimecast.UrlLog.Result string The result of the URL scan
Mimecast.UrlLog.Action string The action that was taken for the click
Mimecast.UrlLog.Route string The route of the original email containing the attachment, either: inbound, outbound, internal, or external
Mimecast.UrlLog. userOverride string The action requested by the user.

mimecast-get-impersonation-logs

Returns Impersonation Protect logs for a Mimecast customer account

Required Permissions

Monitoring Impersonation Protection Read

Base Command

mimecast-get-impersonation-logs

Input

Argument Name Description Required
resultsNumber This parameter is ignored, use the ‘limit’ parameter instead. Possible values are: . Optional
taggedMalicious Filters for messages tagged malicious (true) or not tagged malicious (false). Omit for no tag filtering. Default is true. Possible values are: true, false. Default is true. Optional
searchField The field to search,Defaults is all (meaning all of the preceding fields). Possible values are: senderAddress, recipientAddress, subject, policy, all. Optional
query Required if searchField exists. A character string to search for in the logs. Optional
identifiers Filters logs by identifiers, can include any of newly_observed_domain, internal_user_name, repy_address_mismatch, and targeted_threat_dictionary. you can choose more then one identifier separated by comma. Possible values are: newly_observed_domain, internal_user_name, repy_address_mismatch, targeted_threat_dictionary. Optional
fromDate Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day. Optional
toDate End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request. Optional
actions Filters logs by action, you can choose more then one action separated by comma. Possible values are: delete, hold, bounce, smart_folder, disable_smart_folder, content_expire, meta_expire, stationery, gcc, secure_delivery, delivery_route, document_policy, disable_document_policy, attach_set_policy, remove_email. Optional
limit The maximum number of results to return. Default is 100. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Possible values are: . Optional
page_size Number of results per page to display. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.Impersonation.ResultCount number The total number of IMPERSONATION log lines found for the request
Mimecast.Impersonation.Hits number The number of identifiers that the message triggered
Mimecast.Impersonation.Malicious boolean Whether the message was tagged as malicious
Mimecast.Impersonation.SenderIP string The source IP address of the message
Mimecast.Impersonation.SenderAddress string The email address of the sender of the message
Mimecast.Impersonation.Subject string The subject of the email
Mimecast.Impersonation.Identifiers string The properties of the message that triggered the action: similar_internal_domain, newly_observed_domain, internal_user_name, reply_address_mismatch, and/or targeted_threat_dictionary
Mimecast.Impersonation.Date date The time at which the log was recorded
Mimecast.Impersonation.Action string The action triggered by the email
Mimecast.Impersonation.Policy string The name of the policy definition that triggered the log
Mimecast.Impersonation.ID string Impersonation Log ID
Mimecast.Impersonation.RecipientAddress string The email address of the recipient of the email
Mimecast.Impersonation.External boolean Whether the message was tagged as coming from an external address

mimecast-url-decode

Decodes a given url from mimecast

Required Permissions

Account Dashboard Read

Base Command

mimecast-url-decode

Input

Argument Name Description Required
url URL to decode. Required

Context Output

Path Type Description
URL.Data string The encoded url to parse
URL.Mimecast.DecodedURL string Parsed url

mimecast-discover

discover authentication types that are supported for your account and which base URL to use for the requesting user.
only for API 1.0 users.

Base Command

mimecast-discover

Input

There are no input arguments for this command.

Context Output

Path Type Description
Mimecast.Authentication.AuthenticationTypes string List of authentication types available to the user
Mimecast.Authentication.EmailAddress string Email address of the request sender
Mimecast.Authentication.EmailToken string Email token of the request sender

mimecast-refresh-token

Refresh access key validity
only for API 1.0 users

Base Command

mimecast-refresh-token

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

mimecast-login

Login to generate Access Key and Secret Key
only for API 1.0 users

Base Command

mimecast-login

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

mimecast-get-message

Get the contents or metadata of a given message. This is an archive search command.

Required Permissions

The following permissions are required for this command.

  • Mimecast administrator with at least one of the following permissions: Archive Search Content View.
  • or Mimecast user with delegate permissions to address or user.

Base Command

mimecast-get-message

Input

Argument Name Description Required
messageID Message ID Required
context Defines which copy of the message part to return, must be one of: “delivered” the copy that has been processed by the Mimecast MTA with policies such as URL rewriting applied, OR “received” - the copy of the message that Mimecast originally received. (Only relevant for part argument = message or all) Required
type The message type to return. (Only relevant for part argument = message or all) Optional
part Define what message part to return - download message, get metadata or both. Optional

Context Output

Path Type Description
Mimecast.Message.ID string Message ID
Mimecast.Message.Subject string The message subject.
Mimecast.Message.HeaderDate date The date of the message as defined in the message headers.
Mimecast.Message.Size number The message size.
Mimecast.Message.From string Sender of the message as defined in the message header.
Mimecast.Message.To.EmailAddress string Recipient of the message.
Mimecast.Message.ReplyTo string The value of the Reply-To header.
Mimecast.Message.CC.EmailAddress string Each CC recipient of the message.
Mimecast.Message.EnvelopeFrom string Sender of the message as defined in the message envelope.
Mimecast.Message.Headers.Name string Header’s name.
Mimecast.Message.Headers.Values string Header’s value.
Mimecast.Message.Attachments.FileName string Message attachment’s file name.
Mimecast.Message.Attachments.SHA256 string Message attachment’s SHA256.
Mimecast.Message.Attachments.ID string Message attachment’s ID.
Mimecast.Message.Attachments.Size number Message attachment’s file size.
Mimecast.Message.Attachments.Extension boolean Message attachment’s file extension.
Mimecast.Message.Processed date The date the message was processed by Mimecast in ISO 8601 format.
Mimecast.Message.HasHtmlBody boolean If the message has an HTML body part.
File.Size number File size
File.SHA1 string SHA1 hash of the file
File.SHA256 string SHA256 hash of the file
File.Name string The sample name
File.SSDeep string SSDeep hash of the file
File.EntryID string War-Room Entry ID of the file
File.Info string Basic information of the file
File.Type string File type e.g. “PE”
File.MD5 string MD5 hash of the file
File.Extension string The extension of the file.

mimecast-download-attachments

Download attachments from a specified message. This is an archive search command.

Required Permissions

The following permissions are required for this command.

  • Mimecast administrator with at least one of the following permissions: Archive Search Content View Read.
  • or Mimecast user with delegate permissions to address or user.

Base Command

mimecast-download-attachments

Input

Argument Name Description Required
attachmentID The Mimecast ID of the message attachment to return. (Can be retrieved from mimecast-get-message) Required
attachmentName The Mimecast attachment name, use this argument in order for the extension value to be included in the context data. (Can be retrieved from mimecast-get-message). Optional

Context Output

Path Type Description
File.Size number File Size
File.SHA1 string SHA1 hash of the file
File.SHA256 string SHA256 hash of the file
File.Name string The sample name
File.SSDeep string SSDeep hash of the file
File.EntryID string War-Room Entry ID of the file
File.Info string Basic information of the file
File.Type string File type e.g., “PE”
File.MD5 string MD5 hash of the file
File.Extension string The extension of the file.

mimecast-find-groups

Returns the list of groups according to the specified query.

Required Permissions

Directories Groups Edit

Base Command

mimecast-find-groups

Input

Argument Name Description Required
query_string The string to query. Optional
query_source The group source by which to filter. Possible values are: cloud, ldap. Optional
limit The maximum number of results to return. Optional

Context Output

Path Type Description
Mimecast.Group.Name String The name of the group.
Mimecast.Group.Source String The source of the group.
Mimecast.Group.ID String The Mimecast ID of the group.
Mimecast.Group.NumberOfUsers Number The number of members in the group.
Mimecast.Group.ParentID String The Mimecast ID of the group’s parent.
Mimecast.Group.NumberOfChildGroups Number The number of child groups.

mimecast-get-group-members

Returns the members list for the specified group.

Required Permissions

Services Directory Sync Read

Base Command

mimecast-get-group-members

Input

Argument Name Description Required
group_id The Mimecast ID of the group to return. Required
limit The maximum number of results to return. Optional
all_results Whether to retrieve all results. Optional

Context Output

Path Type Description
Mimecast.Group.Users.Name String The user’s display name.
Mimecast.Group.Users.EmailAddress String The user’s email address.
Mimecast.Group.Users.Domain String The domain name of the user’s email address.
Mimecast.Group.Users.Type String The user type.
Mimecast.Group.Users.InternalUser Boolean Whether the user is internal.
Mimecast.Group.Users.IsRemoved Boolean Whether the user is part of the group.
Mimecast.Group.Users.Notes unknown The notes linked to the group.

mimecast-add-group-member

Adds a user to a group. The email_address and domain_address arguments are optional, but one of them must be supplied.

Required Permissions

Directories Groups Edit

Base Command

mimecast-add-group-member

Input

Argument Name Description Required
group_id The Mimecast ID of the group to add the user to. Required
email_address The email address of the user to add to a group. Optional
domain_address A domain to add to a group. Optional
notes The notes for the entry. Optional

Context Output

Path Type Description
Mimecast.Group.Users.EmailAddress String The user’s email address.
Mimecast.Group.Users.IsRemoved Boolean Whether the user is part of the group.

mimecast-remove-group-member

Removes a user from a group. The email_address and domain_address arguments are optional, but one of them must be
supplied.

Required Permissions

Services Directory Sync Edit

Base Command

mimecast-remove-group-member

Input

Argument Name Description Required
group_id The Mimecast ID of the group from which to remove the user. Required
email_address The email address of the user to remove from the group. Optional
domain_address A domain of the user to remove from a group. Optional

Context Output

Path Type Description
Mimecast.Group.Users.EmailAddress String The user’s email address.
Mimecast.Group.Users.IsRemoved Boolean Whether the user part of the group.

mimecast-create-group

Creates a new Mimecast group.

Required Permissions

Directories Groups Edit

Base Command

mimecast-create-group

Input

Argument Name Description Required
group_name The name of the new group. Required
parent_id The Mimecast ID of the new group’s parent. Default will be root level. Optional

Context Output

Path Type Description
Mimecast.Group.Name String The name of the group.
Mimecast.Group.Source String The source of the group.
Mimecast.Group.ID String The Mimecast ID of the group.
Mimecast.Group.NumberOfUsers Number The number of members in the group.
Mimecast.Group.ParentID String The Mimecast ID of the group’s parent.
Mimecast.Group.NumberOfChildGroups Number The number of child groups.

mimecast-update-group

Updates an existing Mimecast group.

Required Permissions

Services Directory Sync Edit

Base Command

mimecast-update-group

Input

Argument Name Description Required
group_name The new name for the group. Optional
group_id The Mimecast ID of the group to update. Required
parent_id The new parent group. Optional

Context Output

Path Type Description
Mimecast.Group.Name String The name of the group.
Mimecast.Group.ID String The Mimecast ID of the group.
Mimecast.Group.ParentID String The Mimecast ID of the group’s parent.

mimecast-create-remediation-incident

Creates a new Mimecast remediation incident.

Required Permissions

Services Threat Remediation Edit

Base Command

mimecast-create-remediation-incident

Input

Argument Name Description Required
hash_message_id The file hash or messageId value. Required
reason The reason for creating the remediation incident. Required
search_by The message component by which to search. Default is “hash”. Possible values are: hash, messageId. Optional
start_date The start date of messages to remediate. Default value is the previous month. (Format: yyyy-mm-ddThh:mm:ss+0000). Optional
end_date The end date of messages to remediate. Default value is the end of the current day. (Format: yyyy-mm-ddThh:mm:ss+0000). Optional

Context Output

Path Type Description
Mimecast.Incident.ID String The secure Mimecast remediation ID.
Mimecast.Incident.Code String The incident code generated at creation.
Mimecast.Incident.Type String The incident type.
Mimecast.Incident.Reason String The reason provided at the creation of the remediation incident.
Mimecast.Incident.IdentifiedMessages Number The number of messages identified based on the search criteria.
Mimecast.Incident.SuccessfullyRemediatedMessages Number The number successfully remediated messages.
Mimecast.Incident.FailedRemediatedMessages Number The number of messages that failed to remediate.
Mimecast.Incident.MessagesRestored Number The number of messages that were restored from the incident.
Mimecast.Incident.LastModified String The date and time that the incident was last modified.
Mimecast.Incident.SearchCriteria.From String The sender email address or domain.
Mimecast.Incident.SearchCriteria.To String The recipient email address or domain.
Mimecast.Incident.SearchCriteria.MessageID String The message ID used when creating the remediation incident.
Mimecast.Incident.SearchCriteria.FileHash String The file hash used when creating the remediation incident.
Mimecast.Incident.SearchCriteria.StartDate String The start date of included messages.
Mimecast.Incident.SearchCriteria.EndDate String The end date of included messages.

mimecast-get-remediation-incident

Returns a Mimecast remediation incident.

Required Permissions

Services Threat Remediation Read

Base Command

mimecast-get-remediation-incident

Input

Argument Name Description Required
incident_id The Mimecast ID for a remediation incident. Required

Context Output

Path Type Description
Mimecast.Incident.ID String The secure Mimecast remediation ID.
Mimecast.Incident.Code String The incident code generated at creation.
Mimecast.Incident.Type String The incident type.
Mimecast.Incident.Reason String The reason provided when the remediation incident was created.
Mimecast.Incident.IdentifiedMessages Number The number of messages identified based on the search criteria.
Mimecast.Incident.SuccessfullyRemediatedMessages Number The number of successfully remediated messages.
Mimecast.Incident.FailedRemediatedMessages Number The number of messages that failed to remediate.
Mimecast.Incident.MessagesRestored Number The number of messages that were restored from the incident.
Mimecast.Incident.LastModified String The date and time that the incident was last modified.
Mimecast.Incident.SearchCriteria.From String The sender email address or domain.
Mimecast.Incident.SearchCriteria.To String The recipient email address or domain.
Mimecast.Incident.SearchCriteria.MessageID String The message ID used when creating the remediation incident.
Mimecast.Incident.SearchCriteria.FileHash String The file hash used when creating the remediation incident.
Mimecast.Incident.SearchCriteria.StartDate String The start date of included messages.
Mimecast.Incident.SearchCriteria.EndDate String The end date of included messages.

mimecast-search-file-hash

Searches for one or more file hashes in the account. Maximum is 100.

Required Permissions

Services Threat Remediation Read

Base Command

mimecast-search-file-hash

Input

Argument Name Description Required
hashes_to_search List of file hashes to check if they were seen in an account. Required

Context Output

Path Type Description
Mimecast.Hash.HashValue String The file hash value.
Mimecast.Hash.Detected Boolean Whether the hash was found in the account.

mimecast-update-policy

Updates the specified policy.

Base Command

mimecast-update-policy

Input

Argument Name Description Required
policy_id The ID of the policy to update. Required
description A new description for the policy. Optional
fromType The sender type by which to block senders in the policy. This argument must match the fromValue argument. For example, if you specify email_domain, the fromValue must be an email domain. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address, free_mail_domains, header_display_name. Optional
toType The blocked receiver type by which to block receivers in the policy. This argument must match the toValue argument. For example, if you specify email_domain, the fromType must be an email domain. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, individual_email_address. Optional
option The block action. Possible values are: no_action, block_sender. Optional
fromValue The value of the fromType argument. For example, if you specify email_domain for fromType, the fromValue must be an email domain. Optional
toValue The value of the toType argument. For example, if you specify email_domain for toType, the toValue must be an email domain. Optional
fromPart The part from where addresses are pulled. Possible values are: envelope_from, header_from, both. Optional

Context Output

Path Type Description
Mimecast.Policy.ID string Policy ID.
Mimecast.Policy.Sender.Address string Block sender by email address value.
Mimecast.Policy.Sender.Domain string Block sender by domain value.
Mimecast.Policy.Sender.Group string Block sender by group value.
Mimecast.Policy.Bidirectional boolean Whether the blocked policy is bidirectional.
Mimecast.Policy.Receiver.Address string Block emails to receiver type address.
Mimecast.Policy.Receiver.Domain string Block emails to receiver type domain.
Mimecast.Policy.Receiver.Group string Block emails to receiver type group.
Mimecast.Policy.Fromdate date The policy validation start date.
Mimecast.Policy.Todate date The policy expiration date.
Mimecast.Policy.Sender.Type String The sender type.
Mimecast.Policy.Receiver.Type String The receiver type.

mimecast-search-message

Searches a message

Required Permissions

Gateway Tracking Read

Base Command

mimecast-search-message

Input

Argument Name Description Required
search_reason Reason for tracking the email. Possible values are: . Optional
from_date API start parameter. Datetime format is ISO 8601. Possible values are: . Optional
to_date API end parameter Datetime format ISO 8601. Possible values are: . Optional
message_id The internet message id of the message to track. Possible values are: . Optional
from Part of advancedTrackAndTraceOptions object: The sending email address or domain of the messages to track. Possible values are: . Optional
to Part of advancedTrackAndTraceOptions object: The recipient email address or domain of the messages to track. Possible values are: . Optional
subject Part of advancedTrackAndTraceOptions object: The subject of the messages to track. Possible values are: . Optional
sender_IP Part of advancedTrackAndTraceOptions object: The source IP address of the messages to track. Possible values are: . Optional
route An array of routes to filter by. Possible values are internal, outbound and inbound. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.SearchMessage.info String Info regarding the message.
Mimecast.SearchMessage.id String The Mimecast ID of the message. Used to load more information about the message.
Mimecast.SearchMessage.status String The status of the message.
Mimecast.SearchMessage.fromEnv.emailAddress String The email address of the sender.
Mimecast.SearchMessage.fromHdr.displayableName String The display name of the recipient.
Mimecast.SearchMessage.fromHdr.emailAddress String The email address of the recipient.
Mimecast.SearchMessage.to.displayableName String The display name of the recipient.
Mimecast.SearchMessage.to.emailAddress String The email address of the recipient.
Mimecast.SearchMessage.received Date The date and time the message was received by Mimecast.
Mimecast.SearchMessage.subject String The subject of the message.
Mimecast.SearchMessage.senderIP String The source IP address of the message.
Mimecast.SearchMessage.attachments Boolean If the message has attachments.
Mimecast.SearchMessage.route String The route of the message.
Mimecast.SearchMessage.sent Date The date and time that the message was sent / processed by Mimecast.
Mimecast.SearchMessage.spamScore Number Spam score of the email.
Mimecast.SearchMessage.detectionLevel String Detection level of the email.

mimecast-get-message-info

Retrieves detailed information about a specific message.

Required Permissions

Gateway Tracking Read

Base Command

mimecast-get-message-info

Input

Argument Name Description Required
ids The Mimecast ID of the message to load. This is returned by the /api/message-finder/search endpoint. (mimecast-search-message command). Possible values are: . Required
show_recipient_info Default value is true. When argument is true all data from recipientInfo object is presented at command response. Possible values are: true, false. Default is true. Optional
show_delivered_message default value is false .When argument is true all data from deliveredMessage object is presented at command response. Possible values are: true, false. Default is false. Optional
show_retention_info Default value is true.When argument is true all data from retentionInfo object is presented at command response. Possible values are: true, false. Default is true. Optional
show_spam_info Default value is true.When argument is true all spamInfo block is presented at command response. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.extension String Component extension type.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.hash String Component hash.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.mimeType String Component MIME type.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.name String Component name.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.size Number Component size.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.type String Component type.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.deliveryEvent String Description of delivery event.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.emailAddress String Email address of recipient.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.encryptionInfo String Encryption type.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.messageExpiresIn Number Expiration time of message.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.processingServer String Processing server address.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.receiptAcknowledgement String Recipient acknowledgement.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteHost String Remote host address.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteIp String Remote IP address.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteServerGreeting String Remote server greeting.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionEnd Date Transmission end date.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionSize Number Transmission size.
Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionStart Date Transmission start date.
Mimecast.MessageInfo.deliveredMessage.messageInfo.fromEnvelope String Sender mail. (From envelope)
Mimecast.MessageInfo.deliveredMessage.messageInfo.fromHeader String Sender mail. (From header)
Mimecast.MessageInfo.deliveredMessage.messageInfo.processed Date Processed time and date.
Mimecast.MessageInfo.deliveredMessage.messageInfo.route String Message route.
Mimecast.MessageInfo.deliveredMessage.messageInfo.sent Date Message sent time and date.
Mimecast.MessageInfo.deliveredMessage.messageInfo.subject String Message subject.
Mimecast.MessageInfo.deliveredMessage.messageInfo.to String Recipients info.
Mimecast.MessageInfo.deliveredMessage.messageInfo.transmissionInfo String Transmission info.
Mimecast.MessageInfo.deliveredMessage.policyInfo.inherited Boolean Whether policy is inherited.
Mimecast.MessageInfo.deliveredMessage.policyInfo.policyName String Policy name.
Mimecast.MessageInfo.deliveredMessage.policyInfo.policyType String Policy type.
Mimecast.MessageInfo.id String Message ID.
Mimecast.MessageInfo.recipientInfo.messageInfo.binaryEmailSize Number Email size.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.extension String Component extension type.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.hash String Component hash.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.mimeType String Component MIME type.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.name String Component name.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.size Number Component size.
Mimecast.MessageInfo.recipientInfo.messageInfo.components.type String Component type.
Mimecast.MessageInfo.recipientInfo.messageInfo.encryptionInfo String Encryption information.
Mimecast.MessageInfo.recipientInfo.messageInfo.fromEnvelope String The routable email address (From envelope).
Mimecast.MessageInfo.recipientInfo.messageInfo.fromHeader String The routable email address (From header).
Mimecast.MessageInfo.recipientInfo.messageInfo.messageExpiresIn Number Expiry time of message.
Mimecast.MessageInfo.recipientInfo.messageInfo.processed Date Message processed time.
Mimecast.MessageInfo.recipientInfo.messageInfo.processingServer String Message processing server.
Mimecast.MessageInfo.recipientInfo.messageInfo.receiptAcknowledgement String Recipient acknowledgement.
Mimecast.MessageInfo.recipientInfo.messageInfo.receiptEvent String Receipt event name.
Mimecast.MessageInfo.recipientInfo.messageInfo.remoteHost String Remote host address.
Mimecast.MessageInfo.recipientInfo.messageInfo.remoteIp String Remote IP address.
Mimecast.MessageInfo.recipientInfo.messageInfo.remoteServerGreeting String Remote server greeting.
Mimecast.MessageInfo.recipientInfo.messageInfo.sent Date Message send time and date.
Mimecast.MessageInfo.recipientInfo.messageInfo.spamEvent String Spam event name.
Mimecast.MessageInfo.recipientInfo.messageInfo.subject String Message subject.
Mimecast.MessageInfo.recipientInfo.messageInfo.to String Recipient info.
Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionEnd Date Transmission end date.
Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionInfo String Transmission info.
Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionSize Number Transmission size.
Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionStart Date Transmission start date.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.binaryEmailSize Number Email size
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.extension String Component extension type.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.hash String Component hash type.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.mimeType String Component MIME type.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.name String Component name.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.size Number Component size.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.type String Component type.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.encryptionInfo String Encryption information.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.messageExpiresIn Number Expiration time of message.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.processingServer String Processing server address.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.receiptAcknowledgement String Recipient acknowledgement.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.receiptEvent String Receipt event name.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteHost String Remote host address.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteIp String Remote IP address.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteServerGreeting String Remote server greeting.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.spamEvent String Spam event name.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionEnd Date Transmission end date.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionSize Number Transmission size.
Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionStart Date Transmission start date.
Mimecast.MessageInfo.retentionInfo.currentPurgeDate Date Current purge date and time.
Mimecast.MessageInfo.retentionInfo.originalPurgeDate Date Original purge date and time.
Mimecast.MessageInfo.retentionInfo.purgeBasedOn String Value that purge is based on.
Mimecast.MessageInfo.retentionInfo.retentionAdjustmentDays Number Retention adjustment days.
Mimecast.MessageInfo.spamInfo.detectionLevel String Spam detection level.
Mimecast.MessageInfo.spamInfo.dkim.allow Boolean Is DomainKeys Identified Mail (DKIM) allowed.
Mimecast.MessageInfo.spamInfo.dkim.info String DKIM info.
Mimecast.MessageInfo.spamInfo.dmarc.allow Boolean Is Domain-based Message Authentication, Reporting & Conformance (DMARC) allowed.
Mimecast.MessageInfo.spamInfo.dmarc.info String DMARC info.
Mimecast.MessageInfo.spamInfo.greyEmail Boolean Is grey email allowed.
Mimecast.MessageInfo.spamInfo.managedSender.allow Boolean Is Managed Sender allowed.
Mimecast.MessageInfo.spamInfo.managedSender.info String Managed Sender info.
Mimecast.MessageInfo.spamInfo.permittedSender.allow Boolean Is Permitted Sender allowed.
Mimecast.MessageInfo.spamInfo.permittedSender.info String Permitted Sender info.
Mimecast.MessageInfo.spamInfo.rbl.allow Boolean Is Real-time blackhole list (RBL) allowed.
Mimecast.MessageInfo.spamInfo.rbl.info String RBL info.
Mimecast.MessageInfo.spamInfo.spamScore Number Spam score.
Mimecast.MessageInfo.spamInfo.spf.allow Boolean Is Sender Policy Framework (SPF) allowed.
Mimecast.MessageInfo.spamInfo.spf.info String SPF info.
Mimecast.MessageInfo.status String Message status.

mimecast-list-held-message

Get information about held messages, including the reason, hold level, sender and recipients

Required Permissions

Account Dashboard Read

Base Command

mimecast-list-held-message

Input

Argument Name Description Required
admin Whether only results for the currently authenticated user will be returned. Possible values are: true, false. Default is false. Optional
from_date Datetime format ISO 8601. Possible values are: . Optional
to_date Datetime format ISO 8601. Possible values are: . Optional
value Free text to filter results by. Possible values are: . Optional
field_name Message fields to filter based on. Possible values are: all, subject, sender, recipient, reason_code. Optional
page_size Number of results per page to display. Possible values are: . Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Possible values are: . Optional
limit The maximum number of results to return. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.HeldMessage.dateReceived Date The timestamp of the message transmission.
Mimecast.HeldMessage.from.displayableName String The sender name.
Mimecast.HeldMessage.from.emailAddress String The sender email.
Mimecast.HeldMessage.fromHeader.displayableName String The display name of the sender (From header).
Mimecast.HeldMessage.fromHeader.emailAddress String The email address of the sender (From header).
Mimecast.HeldMessage.hasAttachments Boolean Returns true if the message contains attachments. False indicates no attachments.
Mimecast.HeldMessage.id String The Mimecast secure ID for a message.
Mimecast.HeldMessage.policyInfo String Information or definition name triggering the message hold action.
Mimecast.HeldMessage.reason String The summary reason for holding the message.
Mimecast.HeldMessage.reasonCode String Reason code for holding the message.
Mimecast.HeldMessage.reasonId String Mirrors the reason field, formatted without spaces. However, reasonCode should be used instead.
Mimecast.HeldMessage.route String Direction of message being held. Possible values are: INBOUND, OUTBOUND, INTERNAL, EXTERNAL.
Mimecast.HeldMessage.size Number The size of the message in bytes.
Mimecast.HeldMessage.subject String The message subject.
Mimecast.HeldMessage.to.displayableName String The display name of the recipient.
Mimecast.HeldMessage.to.emailAddress String The email address of the recipient.

mimecast-held-message-summary

Get counts of currently held messages for each hold reason.

Required Permissions

Account Monitoring Held Summary Read

Base Command

mimecast-held-message-summary

Input

| Argument Name | Description | Required |
|——————-|—————–|————–|

Context Output

Path Type Description
Mimecast.HeldMessageSummary.numberOfItems Number The number of messages currently held for this reason.
Mimecast.HeldMessageSummary.policyInfo String The name of the policy or definition that held a message.

mimecast-reject-held-message

Reject a currently held message.

Required Permissions

Account Monitoring Held Edit

Base Command

mimecast-reject-held-message

Input

Argument Name Description Required
ids An array of Mimecast secure IDs IDs are extracted from the mimecast-list-held-message command. Possible values are: . Required
message Rejection message to be returned to the sender. Possible values are: . Optional
reason_type User can choose reason . Possible values are: MESSAGE CONTAINS UNDESIRABLE CONTENT,MESSAGE CONTAINS CONFIDENTIAL INFORMATION,REVIEWER DISAPPROVES OF CONTENT,, INAPPROPRIATE COMMUNICATIONMESSAGE GOES AGAINST EMAIL POLICIES, . Optional
notify Whether to deliver rejection notificationd. Possible values are: true, false. Optional

Context Output

There is no context output for this command.

Command example

!mimecast-reject-emessage ids="1234" message="MESSAGE CONTAINS UNDESIRABLE CONTENT" reason_type="MESSAGE CONTAINS UNDESIRABLE CONTENT" notify="True"

Human Readable Output

Held messages were rejected successfully

mimecast-release-held-message

Release a currently held message.

Required Permissions

Account Monitoring Held Edit

Base Command

mimecast-release-held-message

Input

Argument Name Description Required
id Mimecast secure id: ID can be extracted from following command : mimecast-list-held-message. Possible values are: . Required

Context Output

There is no context output for this command.

Command example

!mimecast-release-held-message id="1234-test""

Human Readable Output

Held message with id 1234_test was released successfully

mimecast-search-processing-message

Return messages currently being processed by Mimecast. Note that most of the time, no results are returned.

Required Permissions

Monitoring Processing Read

Base Command

mimecast-search-processing-message

Input

Argument Name Description Required
sort_order The method used to sort the messages. Possible values are: asc, desc. Optional
from_date Datetime format ISO 8601. Possible values are: . Optional
to_date Datetime format ISO 8601. Possible values are: . Optional
value The search value to be used. Possible values are: . Optional
field_name The field to be searched. Possible values are: ALL, fromAddress, toAddress, subject, info, remoteIp. Optional
attachments Whether there is an attachment in the message. Possible values are: . Optional
route The message route. Possible values are: all, internal, outbound, inbound, external. Optional
page_size Number of results per page to display. Possible values are: . Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Possible values are: . Optional
limit The maximum number of results to return. Possible values are: . Optional

Context Output

Path Type Description
Mimecast.ProcessingMessage.messages.id String The Mimecast secure ID of the message.
Mimecast.ProcessingMessage.messages.fromEnv.emailAddress String The routable email address (From evelope).
Mimecast.ProcessingMessage.messages.fromHeader.emailAddress String The routable email address (From header).
Mimecast.ProcessingMessage.messages.to.emailAddress String The routable email address.
Mimecast.ProcessingMessage.messages.subject String The message subject.
Mimecast.ProcessingMessage.messages.attachment Boolean The presence of an attachment in the message.
Mimecast.ProcessingMessage.messages.routing String The directional route of the message. Possible values are internal, outbound, inbound or external.
Mimecast.ProcessingMessage.messages.size Number The size of the message in bytes.
Mimecast.ProcessingMessage.messages.remoteIp String The connecting IP address.
Mimecast.ProcessingMessage.messages.attempts Number The number of processing attempts of the message.
Mimecast.ProcessingMessage.messages.nextAttempt Date The date of the next process attempt for the message.
Mimecast.ProcessingMessage.messages.created Date The date of the processing request creation.
Mimecast.ProcessingMessage.messages.info String Current processing status of the message.
Mimecast.ProcessingMessage.messages.priority String Message proirity.

mimecast-list-email-queues

Get the count of the inbound and outbound email queues at specified times.

Required Permissions

Account Dashboard Read

Base Command

mimecast-list-email-queues

Input

Argument Name Description Required
from_date Datetime format ISO 8601. Possible values are: . Required
to_date Datetime format ISO 8601. Possible values are: . Required

Context Output

Path Type Description
Mimecast.EmailQueue.inboundEmailQueue.count Number The number of inbound messages currently queued.
Mimecast.EmailQueue.inboundEmailQueue.date Date The date for the displayed number of messages.
Mimecast.EmailQueue.outboundEmailQueue.count Number The number of outbound messages currently queued.
Mimecast.EmailQueue.outboundEmailQueue.date Date The date for the displayed number of messages.

Command example

!mimecast-list-email-queues from_date="2015-11-16T14:49:18+0000" to_date="2022-11-16T14:49:18+0000"

Context Example

{
  "Mimecast": {
    "EmailQueue": [
      {
        "inboundEmailQueue": [
          {
            "count": 2,
            "date": "2022-07-19T08:10:00+0000"
          },
          {
            "count": 4,
            "date": "2022-07-19T08:20:00+0000"
          },
          {
            "count": 4,
            "date": "2022-07-19T08:30:00+0000"
          },
          {
            "count": 4,
            "date": "2022-07-19T08:40:00+0000"
          }
        ]
      }
    ]
  }
}

Human Readable Output

Inbound Email Queue

Inbound Email Queue Count Inbound Email Queue Date
2 2022-07-19T08:10:00+0000
4 2022-07-19T08:20:00+0000
4 2022-07-19T08:30:00+0000
4 2022-07-19T08:40:00+0000

mimecast-get-archive-search-logs

Retrieves archived search logs.

Required Permissions

Archive Search Logs Read

Base Command

mimecast-get-archive-search-logs

Input

Argument Name Description Required
query Text to search within the logs, which can contain email addresses. Optional
page Page number for pagination. Optional
page_size Number of items per page for pagination. Default value is ‘50’. Optional
limit The maximum number of items to return. Default is 50. Optional

Context Output

Path Type Description
Mimecast.ArchiveSearchLog.logs.createTime Date The time that the search was executed.
Mimecast.ArchiveSearchLog.logs.emailAddr String The email address of the user who performed the search.
Mimecast.ArchiveSearchLog.logs.source String The source of the search.
Mimecast.ArchiveSearchLog.logs.searchText String The text used in the search.
Mimecast.ArchiveSearchLog.logs.searchReason String The reason for the search.
Mimecast.ArchiveSearchLog.logs.description String The description of the search if any.

Command example

!mimecast-get-archive-search-logs query="Message Tracking Search" limit=1

Context Example

{
    "Mimecast": {
        "ArchiveSearchLog": [
            {
                "createTime": "2024-03-20T11:39:36+0000",
                "description": "Message Tracking Search",
                "emailAddr": "integration.com",
                "searchReason": "",
                "searchText": "eNo1jrs12345",
                "source": "archive"
            }
        ]
    }
}

Human Readable Output

Results

createTime description emailAddr searchReason searchText source
2024-03-20T11:39:36+0000 Message Tracking Search example@test.com   eNo1jrs12345 archive

mimecast-get-search-logs

Retrieves the search logs.

Required Permissions

Archive Search Logs Read

Base Command

mimecast-get-search-logs

Input

Argument Name Description Required
query Text to search within the logs, which can contain email addresses. Optional
start The earliest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the start of the current day. Default is now. Optional
end The latest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the end of the current day. Default is now. Optional
page Page number for pagination. Optional
page_size Number of items per page for pagination. Default value is ‘50’. Optional
limit The maximum number of items to return. Default is 50. Optional

Context Output

Path Type Description
Mimecast.SearchLog.meta.pagination.pageSize Number The number of results per page.
Mimecast.SearchLog.meta.pagination.totalCount Number The total number of search results.
Mimecast.SearchLog.meta.pagination.next String A link to the next page of search results.
Mimecast.SearchLog.meta.status Number The status code of the search operation.
Mimecast.SearchLog.createTime Date The time that the search was executed.
Mimecast.SearchLog.emailAddr String The email address of the user who performed the search.
Mimecast.SearchLog.source String The source context of the search.
Mimecast.SearchLog.searchText String The text used in the search.
Mimecast.SearchLog.searchPath String The search path used in the search.
Mimecast.SearchLog.searchReason String The reason entered when the search was executed.
Mimecast.SearchLog.isAdmin Boolean Indicates if the search was an admin search or not.
Mimecast.SearchLog.museQuery String (Deprecated) The Mimecast search query used, if any.
Mimecast.SearchLog.description String The description of the search, if any.

Command example

!mimecast-get-search-logs start="1 year" limit=1 end=now query="Message Tracking Search"

Context Example

{
    "Mimecast": {
        "SearchLog": {
            "createTime": "2024-03-20T11:39:36+0000",
            "description": "Message Tracking Search",
            "emailAddr": "integration.com",
            "searchReason": "",
            "searchText": "eNo1jrs12345",
            "source": "archive"
        }
    }
}

Human Readable Output

Results

createTime description emailAddr searchReason searchText source
2024-03-20T11:39:36+0000 Message Tracking Search mime.integration.com   eNo1jrs12345 archive

mimecast-get-view-logs

Retrieves the email view logs.

Required Permissions

Archive View Logs Read

Base Command

mimecast-get-view-logs

Input

Argument Name Description Required
query Text to search within the logs, which can contain email addresses. Optional
start The earliest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the start of the current day. Default is now. Optional
end The latest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the end of the current day. Default is now. Optional
page Page number for pagination. Optional
page_size Number of items per page for pagination. Default value is ‘50’. Optional
limit The maximum number of items to return. Default is 50. Optional

Context Output

Path Type Description
Mimecast.ViewLog.viewer String The email address of the user who viewed the message.
Mimecast.ViewLog.source String The source of the message.
Mimecast.ViewLog.viewed Date The date and time that the message was viewed.
Mimecast.ViewLog.from String The sender of the viewed message.
Mimecast.ViewLog.to String The recipient of the viewed message.
Mimecast.ViewLog.subject String The subject of the viewed message.
Mimecast.ViewLog.messageDate Date The date and time that the message was received.
Mimecast.ViewLog.contentViewed Boolean Indicates if the message content was viewed or not.
Mimecast.ViewLog.discoveryCase Boolean Whether the viewed message is a part of an existing discovery case.

Command example

!mimecast-get-view-logs limit=1 start="1 year" end=now

Context Example

{
    "Mimecast": {
        "ViewLog": [
            {
                "contentViewed": false,
                "discoveryCase": false,
                "from": "example@test.com",
                "messageDate": "2023-08-03T10:59:31+0000",
                "source": "Message Tracking",
                "subject": "Re",
                "to": ".integration.com",
                "viewed": "2023-08-03T12:06:01+0000",
                "viewer": "example@test.com"
            }
        ]
    }
}

Human Readable Output

Results

contentViewed discoveryCase from messageDate source subject to viewed viewer
false false example@test.com 2023-08-03T10:59:31+0000 Message Tracking Re example@test.com.mime.integration.com 2023-08-03T12:06:01+0000 example@test.com

mimecast-list-account

This endpoint returns the summary details for an account in Mimecast.

Required Permissions

Account Dashboard Read

Base Command

mimecast-list-account

Input

Argument Name Description Required
account_name The account name. Optional
account_code The unique Mimecast account code for the customer. Optional
admin_email The email address of the first administrator created on the account. Optional
region The region where the account is hosted. Optional
user_count The number of user licenses on the account. Optional
page Page number for pagination. Optional
page_size Number of items per page for pagination. Default value is ‘50’. Optional
limit The maximum number of items to return. Default is 50. Optional

Context Output

Path Type Description
Mimecast.Account.region String The region where the account is hosted.
Mimecast.Account.archive Boolean If archiving features are enabled on the account.
Mimecast.Account.gateway Boolean If gateway features are enabled on the account.
Mimecast.Account.passphrase String The passphrase set on the account, used by Mimecast Support when verifying callers during support calls.
Mimecast.Account.supportCode String The support code.
Mimecast.Account.maxRetention Number The maximum retention in days configured for the account.
Mimecast.Account.maxRetentionConfirmed Boolean If the maximum retention value on the account has been confirmed.
Mimecast.Account.minRetentionEnabled Boolean If minimum retention is enabled on the account.
Mimecast.Account.automatedSegmentPurge Boolean If purging of expired storage segments is enabled on the account.
Mimecast.Account.type String The type of account.
Mimecast.Account.policyInheritance Boolean If policy inheritance is enabled on the account.
Mimecast.Account.databaseCode String The database code.
Mimecast.Account.searchReason Boolean The search reason.
Mimecast.Account.contentAdministratorDefaultView String The content administrator default view.
Mimecast.Account.adminSessionTimeout Number The admin session timeout.
Mimecast.Account.exportApi Boolean If the export API is enabled.
Mimecast.Account.exgestAllowQuery Boolean If the exgest allows queries.
Mimecast.Account.exgestAllowExtraction Boolean If the exgest allows extraction.
Mimecast.Account.expressAccount Boolean If the account is an express account.
Mimecast.Account.cybergraphV2Enabled Boolean If Cybergraph v2 is enabled.
Mimecast.Account.accountCode String The unique Mimecast account code for the customer.
Mimecast.Account.accountName String The account name.
Mimecast.Account.adminEmail String The email address of the first administrator created on the account.
Mimecast.Account.contactEmail String The contact email address.
Mimecast.Account.domain String The temporary domain name added to the account. This name is generated by Mimecast and is only used for initial access to the account. It should not be used for email routing.
Mimecast.Account.userCount Number The number of user licenses on the account.
Mimecast.Account.mimecastId String The unique Mimecast ID of the account.
Mimecast.Account.contactName String The contact name.
Mimecast.Account.telephone Date The telephone number.
Mimecast.Account.packages String An array of packages enabled on the customer account.

Command example

!mimecast-list-account limit=1

Context Example

{
    "Mimecast": {
        "Account": [
            {
                "accountCode": "CUSA102A236",
                "accountName": "API Alliance - Palo Alto Networks",
                "adminEmail": "",
                "adminSessionTimeout": 60,
                "archive": false,
                "automatedSegmentPurge": true,
                "contactEmail": "example@test.com.com",
                "contactName": "Adam Testov",
                "contentAdministratorDefaultView": "Metadata",
                "cybergraphV2Enabled": false,
                "databaseCode": "usterm13",
                "domain": "",
                "exgestAllowExtraction": true,
                "exgestAllowQuery": false,
                "exportApi": false,
                "expressAccount": false,
                "gateway": true,
                "maxRetention": 30,
                "maxRetentionConfirmed": true,
                "mimecastId": "01-0102-00236",
                "minRetentionEnabled": false,
                "packages": [
                    "Attachment Management (Site) [1004]",
                    "Attachment Protection (Site) [1056]",
                    "Threat Remediation [1075]",
                    "Journal Services [1053]",
                    "Mimecast Platform [1033]",
                    "Internal Email Protect [1064]",
                    "Desktop Apps - Outlook (Pro) [1016]",
                    "Desktop Apps - Mac (Pro) [1051]",
                    "BYO: Threat Intelligence [1089]",
                    "Enhanced Logging [1061]",
                    "Message Recovery Service - User [1058]",
                    "Branding [1003]",
                    "Mobile Apps (Pro) [1036]",
                    "Content Control and Data Leak Prevention (Site) [1013]",
                    "Advanced MTA (Site) [1002]",
                    "Email Encryption and Privacy (Site) [1023]",
                    "Metadata Track and Trace (Site) [1032]",
                    "Configuration Backup & Restore [1106]",
                    "Attachment Protection (Pro) [1059]",
                    "Stationery 1.0 (Site) [1042]",
                    "URL Protection (Site) [1043]",
                    "Secure Email Gateway (Site) [1039]",
                    "Content Control and Data Leak Prevention (Pro) [1015]",
                    "Impersonation Protection [1060]",
                    "Auto Responders (Site) [1005]",
                    "Message Recovery Service (Site) [1031]",
                    "Mimecast Mobile Pro (Pro) [1055]",
                    "Analysis and Response [1110]"
                ],
                "passphrase": "",
                "policyInheritance": false,
                "region": "us",
                "searchReason": false,
                "supportCode": "D7F8",
                "telephone": "4088307584",
                "type": "full",
                "userCount": 10
            }
        ]
    }
}

Human Readable Output

Results

accountCode accountName adminEmail adminSessionTimeout archive automatedSegmentPurge contactEmail contactName contentAdministratorDefaultView cybergraphV2Enabled databaseCode domain exgestAllowExtraction exgestAllowQuery exportApi expressAccount gateway maxRetention maxRetentionConfirmed mimecastId minRetentionEnabled packages passphrase policyInheritance region searchReason supportCode telephone type userCount
CUSA102A236 API Alliance - Palo Alto Networks   60 false true example@test.com.com Adam Testov Metadata false usterm13   true false false false true 30 true 01-0102-00236 false Attachment Management (Site) [1004],
Attachment Protection (Site) [1056],
Threat Remediation [1075],
Journal Services [1053],
Mimecast Platform [1033],
Internal Email Protect [1064],
Desktop Apps - Outlook (Pro) [1016],
Desktop Apps - Mac (Pro) [1051],
BYO: Threat Intelligence [1089],
Enhanced Logging [1061],
Message Recovery Service - User [1058],
Branding [1003],
Mobile Apps (Pro) [1036],
Content Control and Data Leak Prevention (Site) [1013],
Advanced MTA (Site) [1002],
Email Encryption and Privacy (Site) [1023],
Metadata Track and Trace (Site) [1032],
Configuration Backup & Restore [1106],
Attachment Protection (Pro) [1059],
Stationery 1.0 (Site) [1042],
URL Protection (Site) [1043],
Secure Email Gateway (Site) [1039],
Content Control and Data Leak Prevention (Pro) [1015],
Impersonation Protection [1060],
Auto Responders (Site) [1005],
Message Recovery Service (Site) [1031],
Mimecast Mobile Pro (Pro) [1055],
Analysis and Response [1110]		   false us false D7F8 4088307584 full 10

mimecast-list-policies

List all existing Mimecast blocked sender policies.

Base Command

mimecast-list-policies

Input

Argument Name Description Required
policyType According to this argument an endpoint is selected. Possible values are: blockedsenders, antispoofing-bypass, address-alteration. Default is blockedsenders. Optional
page The page number you would like to view. Each page contains page_size values. Must be used with page_size. Not supported when policyType is blockedsenders. Optional
page_size Sets the result to start returning results. Default value is ‘50’. Optional
limit The maximum number of results to return. Default is 50. Optional
next_token Pagination token for requesting the next page. Only applicable when policyType is blockedsenders. Optional

Context Output

Path Type Description
Mimecast.BlockedSendersPolicy.policies Unknown The list of blocked-senders policies returned for the current page.
Mimecast.BlockedSendersPolicy.NextToken String The pagination token for the next page of blocked-senders policies.
Mimecast.AddressAlterationPolicy.ID string Policy ID.
Mimecast.AddressAlterationPolicy.meta.status Number The status of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.addressAlterationSetId String The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy.
Mimecast.AddressAlterationPolicy.id String The Mimecast secure ID of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.description String The description for the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromPart String Should the sender address be considered based on the envelope, header, or either address.
Mimecast.AddressAlterationPolicy.policy.from.type String The type of sender address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.to.type String The type of recipient address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromType String The sender address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.toType String The recipient address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromEternal Boolean Should the policy start to apply, regardless of the current date and time, for the sender address.
Mimecast.AddressAlterationPolicy.policy.toEternal Boolean Should the policy start to apply, regardless of the current date and time, for the recipient address.
Mimecast.AddressAlterationPolicy.policy.fromDate String The start date that the policy should begin to apply.
Mimecast.AddressAlterationPolicy.policy.toDate String The end date that the policy should cease to apply.
Mimecast.AddressAlterationPolicy.policy.override Boolean Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
Mimecast.AddressAlterationPolicy.policy.bidirectional Boolean Should the policy also apply in reverse email flow.
Mimecast.AddressAlterationPolicy.policy.conditions Unknown Conditions of the sending platform to determine if the policy should be considered.
Mimecast.AddressAlterationPolicy.policy.enabled Boolean Should the policy be considered for emails processing through Mimecast.
Mimecast.AddressAlterationPolicy.policy.enforced Boolean Is the policy enforced.
Mimecast.AddressAlterationPolicy.policy.createTime String The creation timestamp of the policy.
Mimecast.AddressAlterationPolicy.policy.lastUpdated string Block emails to receiver type.
Mimecast.BlockedSendersPolicy.policies.id String The unique identifier of the blocked senders policy.
Mimecast.BlockedSendersPolicy.policies.description String The description of the blocked senders policy.
Mimecast.BlockedSendersPolicy.policies.from.type String The sender address type considered by the policy.
Mimecast.BlockedSendersPolicy.policies.from.emailAddress String The sender email address considered by the policy.
Mimecast.BlockedSendersPolicy.policies.from.domain String The sender domain considered by the policy.
Mimecast.BlockedSendersPolicy.policies.from.groupId String The sender profile group ID considered by the policy.
Mimecast.BlockedSendersPolicy.policies.to.type String The recipient address type considered by the policy.
Mimecast.BlockedSendersPolicy.policies.to.emailAddress String The recipient email address considered by the policy.
Mimecast.BlockedSendersPolicy.policies.to.domain String The recipient domain considered by the policy.
Mimecast.BlockedSendersPolicy.policies.to.groupId String The recipient profile group ID considered by the policy.
Mimecast.BlockedSendersPolicy.policies.bidirectional Boolean Whether the policy also applies in reverse email flow.
Mimecast.BlockedSendersPolicy.policies.fromDateTime Date The date and time the policy starts to apply.
Mimecast.BlockedSendersPolicy.policies.toDateTime Date The date and time the policy ceases to apply.
Mimecast.BlockedSendersPolicy.policies.fromEternal Boolean Whether the policy applies regardless of the start date.
Mimecast.BlockedSendersPolicy.policies.toEternal Boolean Whether the policy applies regardless of the end date.
Mimecast.BlockedSendersPolicy.policies.fromPart String The sender address type considered, based on the envelope, header, or either address.
Mimecast.BlockedSendersPolicy.policies.enabled Boolean Whether the policy is enabled.
Mimecast.BlockedSendersPolicy.policies.enforced Boolean Whether the policy is enforced.
Mimecast.BlockedSendersPolicy.policies.override Boolean Whether the policy is considered prior to other policies of the same type.
Mimecast.AntispoofingBypassPolicy.option String The option for the antispoofing bypass policy.
Mimecast.AntispoofingBypassPolicy.id String The unique identifier for the antispoofing bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.description String A description of the antispoofing bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromPart String The part of the email address or domain from which the policy is applied.
Mimecast.AntispoofingBypassPolicy.policy.from.type String The type of sender address or domain for the policy.
Mimecast.AntispoofingBypassPolicy.policy.from.emailDomain String The email domain of the sender for the policy.
Mimecast.AntispoofingBypassPolicy.policy.to.type String The type of recipient address or domain for the policy.
Mimecast.AntispoofingBypassPolicy.policy.to.emailDomain String The email domain of the recipient for the policy.
Mimecast.AntispoofingBypassPolicy.policy.fromType String The type of sender for the policy.
Mimecast.AntispoofingBypassPolicy.policy.fromValue String The value of the sender for the policy.
Mimecast.AntispoofingBypassPolicy.policy.toType String The type of recipient for the policy.
Mimecast.AntispoofingBypassPolicy.policy.toValue String The value of the recipient for the policy.
Mimecast.AntispoofingBypassPolicy.policy.fromEternal Boolean Indicates whether the policy applies indefinitely to the sender.
Mimecast.AntispoofingBypassPolicy.policy.toEternal Boolean Indicates whether the policy applies indefinitely to the recipient.
Mimecast.AntispoofingBypassPolicy.policy.fromDate Date The start date from which the policy is effective.
Mimecast.AntispoofingBypassPolicy.policy.toDate Date The end date until which the policy is effective.
Mimecast.AntispoofingBypassPolicy.policy.override Boolean Indicates whether the policy overrides other policies.
Mimecast.AntispoofingBypassPolicy.policy.bidirectional Boolean Indicates whether the policy applies in both directions.
Mimecast.AntispoofingBypassPolicy.policy.conditions.spfDomains String The SPF domains condition for the policy.
Mimecast.AntispoofingBypassPolicy.policy.enabled Boolean Indicates whether the policy is enabled.
Mimecast.AntispoofingBypassPolicy.policy.enforced Boolean Indicates whether the policy is enforced.
Mimecast.AntispoofingBypassPolicy.policy.createTime Date The date and time when the policy was created.
Mimecast.AntispoofingBypassPolicy.policy.lastUpdated Date The date and time when the policy was last updated.

Command example

!mimecast-list-policies policyType="address-alteration" limit=1

Context Example

{
    "Mimecast": {
        "AddressAlterationPolicy": {
            "addressAlterationSetId": "eNoVjr0OgjAYAN-lKw5QoAqJQ5H4AwZQUBM2hKJV5IutFcX47uJ8yd19kGSlEoxXyEXqLNMl8frQfnVci4Mrk8XFwunCq09G3h5MvVknETV4crYK_6htaTaZZw7gFXO4jTecxHcVBTYmmh4WqnprPQ1Fv4jpdkxMv4Z83wDsu3QGUzRCpZIPuDFRQsWG-myXUkPHFJtkgE8mJIcWucYI1dBUTPwXiWUN9u8P87s5UQ",
            "id": "eNo1jk0TgUAAQP_Lns3Y2l1hxsEo5CPCCuOSbWWptrbSxPjvcnB_b957g5yzUnERgD6gzsyI2crn1ITntnMIXTuLUOx6zCZ3o6IFWiti5gyuqbn3LPsiQzpPfNzVtUjFtxPyjyHfZXJKvEK4flr1Jii542WG8XWDSmf_EAfrFWzGC7UcgBZIZSRY_UtrGBPSAqzMCxlzxWTAm58R3Q41qA911GnoJ1e5kEkD_81dnXL7Z0Mdws8XmjlBYQ",
            "policy": {
                "bidirectional": true,
                "conditions": {
                    "sourceIPs": [
                        "8.8.8.8/24"
                    ]
                },
                "createTime": "2024-05-28T10:01:06+0000",
                "description": "test_update",
                "enabled": true,
                "enforced": false,
                "from": {
                    "emailDomain": "google.com",
                    "type": "email_domain"
                },
                "fromDate": "1900-01-01T00:00:00+0000",
                "fromEternal": true,
                "fromPart": "header_from",
                "fromType": "email_domain",
                "fromValue": "google.com",
                "lastUpdated": "2024-05-28T10:01:07+0000",
                "override": true,
                "to": {
                    "emailDomain": "google.com",
                    "type": "email_domain"
                },
                "toDate": "2100-01-01T23:59:59+0000",
                "toEternal": true,
                "toType": "email_domain",
                "toValue": "google.com"
            }
        }
    }
}

Human Readable Output

Mimecast list address-alteration policies

These are the existing address-alteration Policies:

Policy ID Sender Reciever Bidirectional Start End
eNo1jk0TgUAAQP_Lns3Y2l1hxsEo5CPCCuOSbWWptrbSxPjvcnB_b957g5yzUnERgD6gzsyI2crn1ITntnMIXTuLUOx6zCZ3o6IFWiti5gyuqbn3LPsiQzpPfNzVtUjFtxPyjyHfZXJKvEK4flr1Jii542WG8XWDSmf_EAfrFWzGC7UcgBZIZSRY_UtrGBPSAqzMCxlzxWTAm58R3Q41qA911GnoJ1e5kEkD_81dnXL7Z0Mdws8XmjlBYQ Group: null
Email Address: null
Domain: google.com
Type: email_domain		 Group: null
Email Address: null
Domain: google.com
Type: email_domain		 true 1900-01-01T00:00:00+0000 2100-01-01T23:59:59+0000

mimecast-create-block-sender-policy

Creates a blocked sender policy. This command does not set context outputs, use mimecast-get-policy to retrieve the full policy.

Prerequisite

In order to successfully use this endpoint the role assigned to the app must have at least the following level of application permissions granted Gateway Policies Edit.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-create-block-sender-policy

Input

Argument Name Description Required
description Policy description. Required
fromPart Addresses based on. Possible values are: envelope_from, header_from, both. Default is envelope_from. Required
fromType Blocked sender type. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
fromValue Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address. For address_attribute_value, use the from_attribute_id and from_attribute_value arguments instead. Optional
from_attribute_id The secure ID of the address attribute. Required if fromType is address_attribute_value. Optional
from_attribute_value The value to which the address attribute is equal. Required if fromType is address_attribute_value. Optional
toType The receiver type. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
toValue Required if toType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. For address_attribute_value, use the to_attribute_id and to_attribute_value arguments instead. Optional
to_attribute_id The secure ID of the address attribute. Required if toType is address_attribute_value. Optional
to_attribute_value The value to which the address attribute is equal. Required if toType is address_attribute_value. Optional
option The block option. Possible values are: no_action, block_sender. Required
from_date The policy start date in ISO 8601 format (for example, 2024-01-15T12:34:56Z). Optional
to_date The policy end date in ISO 8601 format (for example, 2024-01-15T12:34:56Z). Optional

Context Output

Path Type Description
Mimecast.BlockedSendersPolicy.id String The ID of the newly created blocked senders policy.

mimecast-update-block-sender-policy

Updates an existing blocked senders policy. Only the fields you explicitly provide are sent to the API and updated, while fields you omit are left unchanged on the server. This command does not set context outputs, use mimecast-get-policy to retrieve the updated policy.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-update-block-sender-policy

Input

Argument Name Description Required
policy_id The ID of the policy to update. Required
description A new description for the policy. Optional
fromType The sender type by which to block senders in the policy. For email_domain, profile_group, and individual_email_address, provide the value in the fromValue argument. For address_attribute_value, provide the values in the from_attribute_id and from_attribute_value arguments instead. The everyone, internal_addresses, and external_addresses types require no value. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Optional
toType The blocked receiver type by which to block receivers in the policy. For email_domain, profile_group, and individual_email_address, provide the value in the toValue argument. For address_attribute_value, provide the values in the to_attribute_id and to_attribute_value arguments instead. The everyone, internal_addresses, and external_addresses types require no value. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Optional
option The block action. Possible values are: no_action, block_sender. Optional
fromValue The value of the fromType argument. For example, if you specify email_domain for fromType, the fromValue must be an email_domain. For address_attribute_value, use the from_attribute_id and from_attribute_value arguments instead. Optional
toValue The value of the toType argument. For example, if you specify email_domain for toType, the toValue must be an email_domain. For address_attribute_value, use the to_attribute_id and to_attribute_value arguments instead. Optional
from_attribute_id The secure ID of the address attribute. Required if fromType is address_attribute_value. Optional
from_attribute_value The value to which the address attribute is equal. Required if fromType is address_attribute_value. Optional
to_attribute_id The secure ID of the address attribute. Required if toType is address_attribute_value. Optional
to_attribute_value The value to which the address attribute is equal. Required if toType is address_attribute_value. Optional
fromPart The part from where addresses are pulled. Possible values are: envelope_from, header_from, both. Optional
from_date The policy start date in ISO 8601 format (for example, 2024-01-15T12:34:56Z). Optional
to_date The policy end date in ISO 8601 format (for example, 2024-01-15T12:34:56Z). Optional

Context Output

There is no context output for this command.

mimecast-create-antispoofing-bypass-policy

Create a new Anti-Spoofing SPF based Bypass policy.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-create-antispoofing-bypass-policy

Input

Argument Name Description Required
option The policy action to be taken. Possible values are: disable_bypass, enable_bypass. Required
bidirectional Determines if the policy should apply in both email directions, where the sender and recipient configurations are reversed. Possible values are: yes, no. Optional
comment Comment about the policy. This field is not visible within the Administration Console. Optional
spf_domain Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation. Required
description Narrative to describe the policy for future reference. Required
enabled Determines if the policy should be enabled to process messages. Possible values are: yes, no. Default is yes. Optional
enforced Determines if the policy enforcement option is enabled. Possible values are: yes, no. Default is no. Optional
from_attribute_id The secure ID of the address attribute. Optional
from_attribute_name Name of address attribute. Optional
from_attribute_value Value to which the address attribute is equal to. Optional
from_date Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days ago”. When specified, this will override the fromEternal value to false. Optional
from_eternal Specifies if the policy should have no start date. Possible values are: yes, no. Default is yes. Optional
from_part Policy from part. Possible values are: envelope_from, header_from, both. Optional
to_date Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days”. When specified, this will override the toEternal value to false. Optional
to_eternal Specifies if the policy should have no expiration date. Possible values are: yes, no. Default is yes. Optional
override Specifies if the policy should be set as an override. To be considered prior to equally-specific policies. Possible values are: yes, no. Optional
from_type The scope for which the policy should should be applied. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
from_value Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. Optional
to_type The type of applies on. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
to_value Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values :If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. Optional

Context Output

Path Type Description
Mimecast.AntispoofingBypassPolicy.data.option String The action taken by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.id String The ID of the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.description String The description of the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromPart String The part of the email message considered for the sender address by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.from.type String The type of the sender address considered by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.to.type String The type of the recipient address considered by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromType String The sender address type considered by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.toType String The recipient address type considered by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromEternal Boolean Indicates if the sender address should always be considered, regardless of the current date and time, by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.toEternal Boolean Indicates if the recipient address should always be considered, regardless of the current date and time, by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromDate String The start date from which the Antispoofing Bypass policy should begin to apply.
Mimecast.AntispoofingBypassPolicy.policy.toDate String The end date until which the Antispoofing Bypass policy should apply.
Mimecast.AntispoofingBypassPolicy.policy.override Boolean Indicates if the Antispoofing Bypass policy should be applied prior to other policies of the same type, if conditions are met.
Mimecast.AntispoofingBypassPolicy.policy.bidirectional Boolean Indicates if the Antispoofing Bypass policy should also apply in reverse email flow.
Mimecast.AntispoofingBypassPolicy.policy.conditions.spfDomains String The SPF domains considered by the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.enabled Boolean Indicates if the Antispoofing Bypass policy should be considered for emails processing through Mimecast.
Mimecast.AntispoofingBypassPolicy.policy.enforced Boolean Indicates if the Antispoofing Bypass policy is enforced.
Mimecast.AntispoofingBypassPolicy.policy.createTime String The creation timestamp of the Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.lastUpdated String The most recent modification timestamp of the Antispoofing Bypass policy.

Command example

!mimecast-create-antispoofing-bypass-policy description=test from_type=email_domain from_value=mail.google.com option=disable_bypass to_type=everyone spf_domain=google.com bidirectional=no comment=test

Context Example

{
    "Mimecast": {
        "AntispoofingBypassPolicy": {
            "id": "eNo1jjEOgjAAAP_1234",
            "option": "disable_bypass",
            "policy": {
                "bidirectional": false,
                "conditions": {
                    "spfDomains": [
                        "google.com"
                    ]
                },
                "createTime": "2024-05-29T11:07:20+0000",
                "description": "test",
                "enabled": true,
                "enforced": false,
                "from": {
                    "emailDomain": "mail.google.com",
                    "type": "email_domain"
                },
                "fromDate": "1900-01-01T00:00:00+0000",
                "fromEternal": true,
                "fromPart": "envelope_from",
                "fromType": "email_domain",
                "fromValue": "mail.google.com",
                "lastUpdated": "2024-05-29T11:07:20+0000",
                "override": false,
                "to": {
                    "type": "everyone"
                },
                "toDate": "2100-01-01T23:59:59+0000",
                "toEternal": true,
                "toType": "everyone"
            }
        }
    }
}

Human Readable Output

Anti-Spoofing Bypass policy eNo1jjEOgjAAAP_SVYa12345 was created successfully

mimecast-update-antispoofing-bypass-policy

Update an existing Anti-Spoofing SPF based Bypass policy.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-update-antispoofing-bypass-policy

Input

Argument Name Description Required
description Narrative to describe the policy for future reference. Optional
policy_id The Mimecast secure ID of an existing policy. Use /api/policy/antispoofing-bypass/get-policy to obtain the ID. Required
enabled Determines if the policy should be enabled to process messages. Possible values are: yes, no. Default is yes. Optional
from_date (yyyy-MM-dd’T’HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days”. When specified, this will override the fromEternal value to false. Optional
from_eternal Specifies if the policy should have no start date. Possible values are: yes, no. Default is yes. Optional
from_part Policy from part. Possible values are: envelope_from, header_from, both. Optional
to_date Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days ago”. When specified, this will override the toEternal value to false. Optional
to_eternal Specifies if the policy should have no expiration date. Possible values are: yes, no. Default is yes. Optional
bidirectional Determines if the policy should apply in both email directions, where the sender and recipient configurations are reversed. Possible values are: yes, no. Optional
option The policy action to be taken. Possible values are: disable_bypass, enable_bypass. Required

Context Output

Path Type Description
Mimecast.AntispoofingBypassPolicy.meta.status Number The status of the Mimecast Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.data.option String The action taken by the Mimecast Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.id String The Mimecast secure ID of the Address Alteration Set (folder) applied by the policy.
Mimecast.AntispoofingBypassPolicy.policy.description String The description for the Mimecast Antispoofing Bypass policy.
Mimecast.AntispoofingBypassPolicy.policy.fromPart String The part of the sender’s address considered by the policy.
Mimecast.AntispoofingBypassPolicy.policy.from.type String The sender address type (envelope or header).
Mimecast.AntispoofingBypassPolicy.policy.to.type String The recipient address type (envelope or header).
Mimecast.AntispoofingBypassPolicy.policy.fromType String The sender address type used by the policy (envelope_from, header_from, or both).
Mimecast.AntispoofingBypassPolicy.policy.toType String The recipient address component scoped by the policy.
Mimecast.AntispoofingBypassPolicy.policy.fromEternal Boolean Determines if the policy applies regardless of the current date and time.
Mimecast.AntispoofingBypassPolicy.policy.toEternal Boolean Determines if the policy continues to apply regardless of the current date and time.
Mimecast.AntispoofingBypassPolicy.policy.fromDate Date The start date for the policy to apply.
Mimecast.AntispoofingBypassPolicy.policy.toDate Date The end date for the policy to cease application.
Mimecast.AntispoofingBypassPolicy.policy.override Boolean Determines if the policy applies and takes precedence over other policies of the same type.
Mimecast.AntispoofingBypassPolicy.policy.bidirectional Boolean Determines if the policy applies to reverse email flow.
Mimecast.AntispoofingBypassPolicy.policy.conditions Unknown Conditions used to determine if the policy should be considered.
Mimecast.AntispoofingBypassPolicy.policy.enabled Boolean Determines if the policy is considered for emails processing through Mimecast.
Mimecast.AntispoofingBypassPolicy.policy.enforced Boolean Determines if the policy is enforced.
Mimecast.AntispoofingBypassPolicy.policy.createTime Date The creation timestamp of the policy.
Mimecast.AntispoofingBypassPolicy.policy.lastUpdated Date The most recent modification timestamp of the policy.

Command example

!mimecast-update-antispoofing-bypass-policy option=disable_bypass policy_id=eNo1jrs12345 bidirectional=no description=test enabled=no from_date="3 year" from_eternal=no from_part=both to_date=now to_eternal=no

Context Example

{
    "Mimecast": {
        "AntispoofingBypassPolicy": {
            "id": "eNo1jrs12345",
            "option": "disable_bypass",
            "policy": {
                "bidirectional": false,
                "conditions": {
                    "spfDomains": [
                        "amazon.com"
                    ]
                },
                "createTime": "2024-05-20T09:11:54+0000",
                "description": "test",
                "enabled": false,
                "enforced": false,
                "from": {
                    "type": "everyone"
                },
                "fromDate": "2021-05-29T11:07:29+0000",
                "fromPart": "both",
                "fromType": "everyone",
                "lastUpdated": "2024-05-29T11:07:29+0000",
                "override": false,
                "to": {
                    "type": "everyone"
                },
                "toDate": "2024-05-29T11:07:29+0000",
                "toType": "everyone"
            }
        }
    }
}

Human Readable Output

Policy ID- eNo1jrs12345 has been updated successfully.

mimecast-create-address-alteration-policy

This API endpoint can be used to create a new Address Alteration policy to apply an alteration definition based on sender and recipient values.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-create-address-alteration-policy

Input

Argument Name Description Required
folder_id The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy. To provide this, run the mimecast-list-policies command and use the value from the Mimecast.Policies.addressAlterationSetId field. Required
policy_description A description of the policies for future reference. Required
bidirectional Determines if the policy should apply in both directions, where the from and to configurations are reversed. Possible values are: yes, no. Optional
comment Comment about the policy. This field is not visible within the Administration Console. Optional
conditions Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation. Optional
enabled Determines if the policy should be enabled to process messages. Possible values are: yes, no. Default is yes. Optional
enforced Determines if the policy enforcement option is enabled. Possible values are: yes, no. Default is no. Optional
from_date string (yyyy-MM-dd’T’HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days”. When specified, this will override the fromEternal value to false. Optional
from_eternal Specifies if the policy should have no start date. Possible values are: yes, no. Default is yes. Optional
from_part Policy from part. Possible values are: envelope_from, header_from, both. Optional
to_date Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days”. When specified, this will override the toEternal value to false. Optional
to_eternal Specifies if the policy should have no expiration date. Possible values are: yes, no. Default is yes. Optional
override Specifies if the policy should be set as an override. To be considered prior to equally-specific policies. Possible values are: yes, no. Optional
from_type The type of applies on. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
to_type The type of applies on. Possible values are: everyone, internal_addresses, external_addresses, email_domain, profile_group, address_attribute_value, individual_email_address. Required
from_value Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address. Optional
to_value Required if toType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. Optional

Context Output

Path Type Description
Mimecast.AddressAlterationPolicy.meta.status Number The status of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.addressAlterationSetId String The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy.
Mimecast.AddressAlterationPolicy.id String The Mimecast secure ID of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.description String The description for the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromPart String Should the sender address be considered based on the envelope, header, or either address.
Mimecast.AddressAlterationPolicy.policy.from.type String The type of sender address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.to.type String The type of recipient address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromType String The sender address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.toType String The recipient address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromEternal Boolean Should the policy start to apply, regardless of the current date and time, for the sender address.
Mimecast.AddressAlterationPolicy.policy.toEternal Boolean Should the policy start to apply, regardless of the current date and time, for the recipient address.
Mimecast.AddressAlterationPolicy.policy.fromDate String The start date that the policy should begin to apply.
Mimecast.AddressAlterationPolicy.policy.toDate String The end date that the policy should cease to apply.
Mimecast.AddressAlterationPolicy.policy.override Boolean Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
Mimecast.AddressAlterationPolicy.policy.bidirectional Boolean Should the policy also apply in reverse email flow.
Mimecast.AddressAlterationPolicy.policy.conditions Unknown Conditions of the sending platform to determine if the policy should be considered.
Mimecast.AddressAlterationPolicy.policy.enabled Boolean Should the policy be considered for emails processing through Mimecast.
Mimecast.AddressAlterationPolicy.policy.enforced Boolean Is the policy enforced.
Mimecast.AddressAlterationPolicy.policy.createTime String The creation timestamp of the policy.
Mimecast.AddressAlterationPolicy.policy.lastUpdated String The most recent modification timestamp of the policy.

Command example

!mimecast-create-address-alteration-policy folder_id=eNo1jrs12345 from_type=everyone to_type=everyone policy_description=test

Context Example

{
    "Mimecast": {
        "AddressAlterationPolicy": {
            "addressAlterationSetId": "eNo1jrs12345",
            "id": "1234",
            "policy": {
                "bidirectional": false,
                "conditions": {},
                "createTime": "2024-05-29T11:07:23+0000",
                "description": "test",
                "enabled": true,
                "enforced": false,
                "from": {
                    "type": "everyone"
                },
                "fromDate": "1900-01-01T00:00:00+0000",
                "fromEternal": true,
                "fromPart": "envelope_from",
                "fromType": "everyone",
                "lastUpdated": "2024-05-29T11:07:23+0000",
                "override": false,
                "to": {
                    "type": "everyone"
                },
                "toDate": "2100-01-01T23:59:59+0000",
                "toEternal": true,
                "toType": "everyone"
            }
        }
    }
}

Human Readable Output

Address Alteration policy was created successfully

mimecast-update-address-alteration-policy

Update an existing Address Alteration policy.

Required Permissions

Gateway Policies Edit

Base Command

mimecast-update-address-alteration-policy

Input

Argument Name Description Required
policy_id The Mimecast secure ID of the Address Alteration policy to be modified. Required
policy_description A description of the policies for future reference. Optional
bidirectional Determines if the policy should apply in both directions, where the from and to configurations are reversed. Possible values are: yes, no. Optional
comment Comment about the policy. This field is not visible within the Administration Console. Optional
conditions Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation. Optional
enabled Determines if the policy should be enabled to process messages. Possible values are: yes, no. Default is yes. Optional
enforced Determines if the policy enforcement option is enabled. Possible values are: yes, no. Default is no. Optional
from_date string (yyyy-MM-dd’T’HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days ago”. When specified, this will override the fromEternal value to false. Optional
from_eternal Specifies if the policy should have no start date. Possible values are: yes, no. Default is yes. Optional
from_part Policy from part. Possible values are: envelope_from, header_from, both. Optional
to_date Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as “3 days ago”. When specified, this will override the toEternal value to false. Optional
to_eternal Specifies if the policy should have no expiration date. Possible values are: yes, no. Default is yes. Optional
override Specifies if the policy should be set as an override. To be considered prior to equally-specific policies. Possible values are: yes, no. Optional

Context Output

Path Type Description
Mimecast.AddressAlterationPolicy.meta.status Number The status of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.id String The Mimecast secure ID of the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.description String The description for the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromPart String Should the sender address be considered based on the envelope, header, or either address.
Mimecast.AddressAlterationPolicy.policy.from.type String The type of sender address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.to.type String The type of recipient address considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromType String The sender address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.toType String The recipient address type considered by the Address Alteration policy.
Mimecast.AddressAlterationPolicy.policy.fromEternal Boolean Should the policy start to apply, regardless of the current date and time, for the sender address.
Mimecast.AddressAlterationPolicy.policy.toEternal Boolean Should the policy start to apply, regardless of the current date and time, for the recipient address.
Mimecast.AddressAlterationPolicy.policy.fromDate String The start date that the policy should begin to apply.
Mimecast.AddressAlterationPolicy.policy.toDate String The end date that the policy should cease to apply.
Mimecast.AddressAlterationPolicy.policy.override Boolean Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
Mimecast.AddressAlterationPolicy.policy.bidirectional Boolean Should the policy also apply in reverse email flow.
Mimecast.AddressAlterationPolicy.policy.conditions Unknown Conditions of the sending platform to determine if the policy should be considered.
Mimecast.AddressAlterationPolicy.policy.enabled Boolean Should the policy be considered for emails processing through Mimecast.
Mimecast.AddressAlterationPolicy.policy.enforced Boolean Is the policy enforced.
Mimecast.AddressAlterationPolicy.policy.createTime String The creation timestamp of the policy.
Mimecast.AddressAlterationPolicy.policy.lastUpdated String The most recent modification timestamp of the policy.

Command example

!mimecast-update-address-alteration-policy policy_id=eNo1jrs12345 bidirectional=no comment=test conditions=8.8.8.8/24 enabled=no enforced=no from_date="3 year" from_eternal=no from_part=both override=no policy_description=test to_date=now to_eternal=no

Context Example

{
    "Mimecast": {
        "AddressAlterationPolicy": {
            "id": "eNo1jrs12345",
            "policy": {
                "bidirectional": false,
                "conditions": {
                    "sourceIPs": [
                        "8.8.8.8/24"
                    ]
                },
                "createTime": "2024-05-26T06:38:11+0000",
                "description": "test",
                "enabled": false,
                "enforced": false,
                "from": {
                    "type": "everyone"
                },
                "fromDate": "2021-05-29T11:07:32+0000",
                "fromPart": "both",
                "fromType": "everyone",
                "lastUpdated": "2024-05-29T11:07:32+0000",
                "override": false,
                "to": {
                    "type": "everyone"
                },
                "toDate": "2024-05-29T11:07:32+0000",
                "toType": "everyone"
            }
        }
    }
}

Human Readable Output

eNo1jrs12345 has been updated successfully

Configuration parameters

  • baseUrl — BaseUrl - API url (required)
  • client_id — Client ID
  • client_secret — Client Secret
  • appId — App ID
  • credentials — User Email Address (Use for auto token refresh)
  • email — User Email Address (Use for auto token refresh)
  • password — Password
  • appKey_creds — App Key
  • appKey — App key
  • accessKey — AccessKey
  • secretKey_creds — Secret Key
  • secretKey — SecretKey
  • isFetch — Fetch incidents
  • fetchURL — Fetch URL incidents
  • fetchAttachments — Fetch attachment incidents
  • fetchImpersonations — Fetch impersonation incidents
  • incidentsToFetch — Fetch incident types
  • incidentType — Incident type
  • fetchDelta — Hours before first fetch to retrieve incidents
  • max_fetch — Max fetch limit
  • new_insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (47)

  • mimecast-add-group-member

    Adds a user to a group. The email_address and domain_address arguments are optional, but one of them must be supplied.

  • mimecast-create-address-alteration-policy

    This API endpoint can be used to create a new Address Alteration policy to apply an alteration definition based on sender and recipient values.

  • mimecast-create-antispoofing-bypass-policy

    Create a new Anti-Spoofing SPF based Bypass policy.

  • mimecast-create-block-sender-policy

    Creates a blocked sender policy. This command does not set context outputs, use mimecast-get-policy to retrieve the full policy.

  • mimecast-create-group

    Creates a new Mimecast group.

  • mimecast-create-managed-url

    Create a managed URL on Mimecast.

  • mimecast-create-policy Deprecated

    Deprecated. Use mimecast-create-block-sender-policy instead.

  • mimecast-create-remediation-incident

    Creates a new Mimecast remediation incident.

  • mimecast-delete-policy

    Deletes a policy by ID.

  • mimecast-discover

    discover authentication types that are supported for your account and which base URL to use for the requesting user.

  • mimecast-download-attachments

    Download attachments from a specified message. This is an archive search command.

  • mimecast-find-groups

    Returns the list of groups according to the specified query.

  • mimecast-get-archive-search-logs

    Retrieves archived search logs.

  • mimecast-get-attachment-logs

    Returns Attachment Protect logs for a Mimecast customer account.

  • mimecast-get-group-members

    Returns the members list for the specified group.

  • mimecast-get-impersonation-logs

    Returns Impersonation Protect logs for a Mimecast customer account.

  • mimecast-get-message

    Get the contents or metadata of a given message. This is an archive search command.

  • mimecast-get-message-info

    Retrieves detailed information about a specific message.

  • mimecast-get-policy

    Get a policy by ID.

  • mimecast-get-remediation-incident

    Returns a Mimecast remediation incident.

  • mimecast-get-search-logs

    Retrieves the search logs.

  • mimecast-get-url-logs

    Returns URL protect logs for a Mimecast customer account. Default value of scanResult as malicious.

  • mimecast-get-view-logs

    Retrieves the email view logs.

  • mimecast-held-message-summary

    Get counts of currently held messages for each hold reason.

  • mimecast-list-account

    This endpoint returns the summary details for an account in Mimecast.

  • mimecast-list-blocked-sender-policies

    Deprecated. Use mimecast-list-policies instead.

  • mimecast-list-email-queues

    Get the count of the inbound and outbound email queues at specified times.

  • mimecast-list-held-message

    Get information about held messages, including the reason, hold level, sender and recipients.

  • mimecast-list-managed-url

    Get a list of all managed URLs.

  • mimecast-list-messages

    Get a list of messages for a given user. This is an archive search command.

  • mimecast-list-policies

    List all existing Mimecast blocked sender policies.

  • mimecast-login

    Login to generate Access Key and Secret Key.

  • mimecast-manage-sender

    Permit or block a specific sender.

  • mimecast-query

    Query Mimecast emails. This is an archive search command.

  • mimecast-refresh-token

    Refresh access key validity.

  • mimecast-reject-held-message

    Reject a currently held message.

  • mimecast-release-held-message

    Release a currently held message.

  • mimecast-remove-group-member

    Removes a user from a group. The email_address and domain_address arguments are optional, but one of them must be supplied.

  • mimecast-search-file-hash

    Searches for one or more file hashes in the account. Maximum is 100.

  • mimecast-search-message

    Searches a message.

  • mimecast-search-processing-message

    Return messages currently being processed by Mimecast. Note that most of the time, no results are returned.

  • mimecast-update-address-alteration-policy

    Update an existing Address Alteration policy.

  • mimecast-update-antispoofing-bypass-policy

    Update an existing Anti-Spoofing SPF based Bypass policy.

  • mimecast-update-block-sender-policy

    Updates an existing blocked senders policy. Only the fields you explicitly provide are sent to the API and updated, while fields you omit are left unchanged on the server. This command does not set context outputs, use mimecast-get-policy to retrieve the updated policy.

  • mimecast-update-group

    Updates an existing Mimecast group.

  • mimecast-update-policy Deprecated

    Deprecated. Use mimecast-update-block-sender-policy instead.

  • mimecast-url-decode

    Decodes a given url from mimecast.

Source

MimecastV2.py MimecastV2_test.py MimecastV2.yml MimecastV2_description.md command_examples.txt
Download History Raw 
category: Email
provider: Permira
commonfields:
  id: MimecastV2
  version: -1
configuration:
- defaultvalue: https://api.services.mimecast.com
  display: BaseUrl - API url
  name: baseUrl
  required: true
  type: 0
  section: Connect
- display: Client ID
  name: client_id
  type: 0
  additionalinfo: For API 2.0
  section: Connect
- display: Client Secret
  name: client_secret
  type: 9
  displaypassword: Client Secret
  hiddenusername: true
  additionalinfo: For API 2.0
  section: Connect
- display: App ID
  name: appId
  type: 0
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: User Email Address (Use for auto token refresh)
  name: credentials
  type: 9
  required: false
  additionalinfo: For API 1.0
  displaypassword: Password
  section: Connect
  advanced: true
- display: User Email Address (Use for auto token refresh)
  name: email
  type: 0
  required: false
  hidden: true
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: Password
  name: password
  type: 4
  hidden: true
  required: false
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: App Key
  name: appKey_creds
  type: 9
  displaypassword: App Key
  additionalinfo: For API 1.0
  hiddenusername: true
  required: false
  section: Connect
  advanced: true
- display: App key
  name: appKey
  type: 4
  hidden: true
  required: false
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: AccessKey
  name: accessKey
  type: 0
  required: false
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: Secret Key
  name: secretKey_creds
  type: 9
  required: false
  displaypassword: Secret Key
  additionalinfo: For API 1.0
  hiddenusername: true
  section: Connect
  advanced: true
- display: SecretKey
  name: secretKey
  type: 4
  hidden: true
  required: false
  additionalinfo: For API 1.0
  section: Connect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Fetch URL incidents
  name: fetchURL
  type: 8
  hidden: true
  required: false
  section: Collect
- display: Fetch attachment incidents
  name: fetchAttachments
  type: 8
  hidden: true
  required: false
  section: Collect
- display: Fetch impersonation incidents
  name: fetchImpersonations
  type: 8
  hidden: true
  required: false
  section: Collect
- additionalinfo: Fetch specific incident types. Default value is "All".
  defaultvalue: All
  display: Fetch incident types
  name: incidentsToFetch
  options:
  - All
  - Impersonation
  - Attachments
  - Url
  - Held Messages
  type: 16
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '24'
  display: Hours before first fetch to retrieve incidents
  name: fetchDelta
  type: 0
  required: false
  section: Collect
- defaultvalue: '100'
  display: Max fetch limit
  name: max_fetch
  type: 0
  required: false
  additionalinfo: Limit for each fetched incident type. Recommended value is 100. Maximum value is 200.
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: new_insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  additionalinfo: Set the Incidents Fetch Interval to a maximum of 15 minutes if the number of incidents is expected to exceed the specified max fetch limit in each fetch cycle.
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: Use the Mimecast integration to manage email security, continuity, and archiving services.
display: Mimecast v2
name: MimecastV2
script:
  commands:
  - arguments:
    - default: true
      description: The query string xml for the search using Mimecast Unified Search Experience (MUSE) - read more on https://community.mimecast.com/docs/DOC-2262, using this will override other query arguments.
      name: queryXml
    - description: Search for this text in messages.
      name: text
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Will not execute the query, but just return the query string built.
      name: dryRun
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Search in specific dates only.
      name: date
      predefined:
      - today
      - yesterday
      - last_week
      - last_month
      - last_year
    - description: Search emails from date, format YYYY-MM-DDTHH:MM:SZ (e.g. 2015-09-21T23:00:00Z).
      name: dateFrom
    - description: Search emails to date, format YYYY-MM-DDTHH:MM:SZ (e.g. 2015-09-21T23:00:00Z).
      name: dateTo
    - description: Filter on messages to a specific address.
      name: sentTo
    - description: Filter on messages from a specific address.
      name: sentFrom
    - description: Search email by subject, will override the text argument.
      name: subject
    - auto: PREDEFINED
      description: 'These are the attachment types available: optional - messages with and without attachments any - messages with any attachment documents - messages with doc, dot, docx, docm, dotx, dotm, pdf, rtf, html attachments spreadsheets - messages with xls, xlt, xlsx, xlsm, xltx, xltm, xlsb, xlam, csv attachments presentations - messages with ppt, pptx, pptm, potx, potm, ppam, ppsx, ppsm, sldx, sldm, thms, pps attachments text - messages with txt, text, html, log attachments images - messages with jpg, jpeg, png, bmp, gif, psd, tif, tiff attachments media - messages with mp3, mp4, m4a, mpg, mpeg, avi, wav, aac, wma, mov attachments zips - messages with zip, rar, cab, gz, gzip, 7z attachments none - No attachments are to be present in the results.'
      name: attachmentType
      predefined:
      - optional
      - any
      - documents
      - spreadsheets
      - presentations
      - text
      - images
      - media
      - zips
      - none
    - description: Search for text in attachments.
      name: attachmentText
    - description: Search email by text in body, will override the text and subject arguments.
      name: body
    - description: Number of results per page to display.
      name: pageSize
    - description: Sets the result to start returning results (default 0).
      name: startRow
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Defines if the search should query recently received messages that are not fully processed yet (default false). You can search by mailbox and date time across active messages.
      name: active
      predefined:
      - 'true'
      - 'false'
    - name: limit
      description: The maximum number of results to return.
      defaultValue: "20"
      predefined:
      - ""
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    description: Query Mimecast emails. This is an archive search command.
    name: mimecast-query
    outputs:
    - contextPath: Mimecast.Message.ID
      description: Message ID.
      type: string
    - contextPath: Mimecast.Message.Subject
      description: Message subject.
      type: string
    - contextPath: Mimecast.Message.Sender
      description: Message sender address.
      type: string
    - contextPath: Mimecast.Message.Recipient
      description: Message recipient address.
      type: string
    - contextPath: Mimecast.Message.RecievedDate
      description: Message received date.
      type: date
    - contextPath: Mimecast.Message.Size
      description: The size of the message in bytes.
      type: number
    - contextPath: Mimecast.Message.AttachmentCount
      description: Message attachments count.
      type: number
    - contextPath: Mimecast.Message.Status
      description: Message status.
      type: string
  - description: Deprecated. Use mimecast-list-policies instead.
    name: mimecast-list-blocked-sender-policies
    outputs:
    - contextPath: Mimecast.Policy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.Policy.Sender.Address
      description: Block Sender by email address.
      type: string
    - contextPath: Mimecast.Policy.Sender.Domain
      description: Block Sender by domain.
      type: string
    - contextPath: Mimecast.Policy.Sender.Group
      description: Block Sender by group.
      type: string
    - contextPath: Mimecast.Policy.Bidirectional
      description: Blocked policy is bidirectional or not.
      type: boolean
    - contextPath: Mimecast.Policy.Receiver.Address
      description: Block emails to receiver type address.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Domain
      description: Block emails to receiver type domain.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Group
      description: Block emails to receiver type group.
      type: string
    - contextPath: Mimecast.Policy.FromDate
      description: Policy validation start date.
      type: date
    - contextPath: Mimecast.Policy.ToDate
      description: Policy expiration date.
      type: date
    - contextPath: Mimecast.Policy.Sender.Type
      description: Block emails to sender type.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Type
      description: Block emails to receiver type.
      type: string
  - arguments:
    - description: Policy ID. The policy ID can be retrieved from the data.id field using the mimecast-list-policies command. For type address-alteration provide the folderId from the data.addressAlterationSetId field.
      name: policyID
      required: true
    - description: Policy type.
      name: policyType
      defaultValue: blockedsenders
      auto: PREDEFINED
      predefined:
      - blockedsenders
      - antispoofing-bypass
      - address-alteration
    description: Get a policy by ID.
    name: mimecast-get-policy
    outputs:
    - contextPath: Mimecast.BlockedSendersPolicy.id
      description: The unique identifier of the blocked senders policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.description
      description: A description of the blocked senders policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.from.type
      description: The sender address type considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.from.emailAddress
      description: The sender email address considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.from.domain
      description: The sender domain considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.from.groupId
      description: The sender profile group ID considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.to.type
      description: The recipient address type considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.to.emailAddress
      description: The recipient email address considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.to.domain
      description: The recipient domain considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.to.groupId
      description: The recipient profile group ID considered by the policy.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.bidirectional
      description: Whether the policy also applies in reverse email flow.
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.fromDateTime
      description: The date and time the policy starts to apply.
      type: Date
    - contextPath: Mimecast.BlockedSendersPolicy.toDateTime
      description: The date and time the policy ceases to apply.
      type: Date
    - contextPath: Mimecast.BlockedSendersPolicy.fromEternal
      description: Whether the policy applies regardless of the start date.
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.toEternal
      description: Whether the policy applies regardless of the end date.
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.fromPart
      description: The sender address type considered, based on the envelope, header, or either address.
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.enabled
      description: Whether the policy is enabled.
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.enforced
      description: Whether the policy is enforced.
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.override
      description: Whether the policy is considered prior to other policies of the same type.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.ID
      description: The policy ID.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Sender.Address
      description: Block Sender by email address.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Sender.Domain
      description: Block Sender by domain.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Sender.Group
      description: Block Sender by group.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Bidirectional
      description: Blocked policy is bidirectional or not.
      type: boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.Receiver.Address
      description: Block emails to receiver type address.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Receiver.Domain
      description: Block emails to receiver type domain.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Receiver.Group
      description: Block emails to receiver type group.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.Fromdate
      description: Policy validation start date.
      type: date
    - contextPath: Mimecast.AntispoofingBypassPolicy.Todate
      description: Policy expiration date.
      type: date
    - contextPath: Mimecast.AddressAlterationPolicy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Sender.Address
      description: Block Sender by email address.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Sender.Domain
      description: Block Sender by domain.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Sender.Group
      description: Block Sender by group.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Bidirectional
      description: Blocked policy is bidirectional or not.
      type: boolean
    - contextPath: Mimecast.AddressAlterationPolicy.Receiver.Address
      description: Block emails to receiver type address.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Receiver.Domain
      description: Block emails to receiver type domain.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Receiver.Group
      description: Block emails to receiver type group.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.Fromdate
      description: Policy validation start date.
      type: date
    - contextPath: Mimecast.AddressAlterationPolicy.Todate
      description: Policy expiration date.
      type: date
  - arguments:
    - description: Policy description.
      name: description
      required: true
    - auto: PREDEFINED
      defaultValue: envelope_from
      description: Addresses based on.
      name: fromPart
      predefined:
      - envelope_from
      - header_from
      - both
    - auto: PREDEFINED
      description: Blocked Sender type.
      name: fromType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - individual_email_address
      required: true
    - description: 'Required if fromType is one of email domain, profile group, individual email address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address.'
      name: fromValue
    - auto: PREDEFINED
      description: Receiver type.
      name: toType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      - free_mail_domains
      - header_display_name
      required: true
    - description: 'Required if fromType is one of email domain, profile group, individual email address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address.'
      name: toValue
    - auto: PREDEFINED
      description: 'The block option, must be one of: no_action, block_sender.'
      name: option
      predefined:
      - no_action
      - block_sender
      required: true
    description: Deprecated. Use mimecast-create-block-sender-policy instead.
    name: mimecast-create-policy
    deprecated: true
    outputs:
    - contextPath: Mimecast.Policy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.Policy.Sender.Address
      description: Block Sender by email address.
      type: string
    - contextPath: Mimecast.Policy.Sender.Domain
      description: Block Sender by domain.
      type: string
    - contextPath: Mimecast.Policy.Sender.Group
      description: Block Sender by group.
      type: string
    - contextPath: Mimecast.Policy.Bidirectional
      description: Blocked policy is bidirectional or not.
      type: boolean
    - contextPath: Mimecast.Policy.Receiver.Address
      description: Block emails to receiver type address.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Domain
      description: Block emails to receiver type domain.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Group
      description: Block emails to receiver type group.
      type: string
    - contextPath: Mimecast.Policy.Fromdate
      description: Policy validation start date.
      type: date
    - contextPath: Mimecast.Policy.Todate
      description: Policy expiration date.
      type: date
    - contextPath: Mimecast.Policy.Sender.Type
      description: The sender type.
      type: String
    - contextPath: Mimecast.Policy.Receiver.Type
      description: The receiver type.
      type: String
  - arguments:
    - description: Policy ID. The policy ID can be retrieved from the data.id field using the mimecast-list-policies command.
      name: policyID
      required: true
    - description: The type of policy to delete.
      name: policyType
      defaultValue: blockedsenders
      auto: PREDEFINED
      predefined:
      - antispoofing-bypass
      - address-alteration
      - blockedsenders
    description: Deletes a policy by ID.
    execution: true
    name: mimecast-delete-policy
    outputs:
    - contextPath: Mimecast.Policy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.BlockedSendersPolicy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.AntispoofingBypassPolicy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.ID
      description: Policy ID.
      type: string
  - arguments:
    - description: The email address of sender to permit or block.
      name: sender
      required: true
    - description: The email address of recipient to permit or block.
      name: recipient
      required: true
    - auto: PREDEFINED
      description: Choose to either "permit" (to bypass spam checks) or "block" (to reject the email).
      name: action
      predefined:
      - permit
      - block
      required: true
    - name: limit
      description: The maximum number of results to return.
      defaultValue: "20"
      predefined:
      - ""
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    description: Permit or block a specific sender.
    name: mimecast-manage-sender
    outputs:
    - contextPath: Mimecast.Managed.Sender
      description: The email address of the sender.
      type: string
    - contextPath: Mimecast.Managed.Recipient
      description: The email address of the recipient.
      type: string
    - contextPath: Mimecast.Managed.Action
      description: Chosen action.
      type: string
    - contextPath: Mimecast.Managed.ID
      description: The Mimecast secure ID of the managed sender object.
      type: string
    compliantpolicies:
    - Domain Blockage
  - arguments:
    - description: Filter results by specific URL.
      name: url
    description: Get a list of all managed URLs.
    name: mimecast-list-managed-url
    outputs:
    - contextPath: Mimecast.URL.Domain
      description: The managed domain.
      type: string
    - contextPath: Mimecast.URL.Disablelogclick
      description: If logging of user clicks on the URL is disabled.
      type: boolean
    - contextPath: Mimecast.URL.Action
      description: Either block of permit.
      type: string
    - contextPath: Mimecast.URL.Path
      description: The path of the managed URL.
      type: string
    - contextPath: Mimecast.URL.matchType
      description: Either explicit - applies to the full URL or domain - applies to all URL values in the domain.
      type: string
    - contextPath: Mimecast.URL.ID
      description: The Mimecast secure ID of the managed URL.
      type: string
    - contextPath: Mimecast.URL.disableRewrite
      description: If rewriting of this URL in emails is disabled.
      type: boolean
  - arguments:
    - description: The URL to block or permit. Do not include a fragment (#).
      name: url
      required: true
    - auto: PREDEFINED
      description: Set to "block" to block list the URL, "permit" to add to allow list.
      name: action
      predefined:
      - block
      - permit
      required: true
    - auto: PREDEFINED
      defaultValue: explicit
      description: Set to "explicit" to block or permit only instances of the full URL. Set to "domain" to block or permit any URL with the same domain.
      name: matchType
      predefined:
      - explicit
      - domain
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Disable rewriting of this URL in emails. Applies only if action = "permit". Default false.
      name: disableRewrite
      predefined:
      - 'true'
      - 'false'
    - description: Add a comment about the managed URL.
      name: comment
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Disable User Awareness challenges for this URL. Applies only if action = "permit". Default false.
      name: disableUserAwareness
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Disable logging of user clicks on the URL. Default is false.
      name: disableLogClick
      predefined:
      - 'true'
      - 'false'
    description: Create a managed URL on Mimecast.
    name: mimecast-create-managed-url
    outputs:
    - contextPath: Mimecast.URL.Domain
      description: The managed domain.
      type: string
    - contextPath: Mimecast.URL.Action
      description: Either block of permit.
      type: string
    - contextPath: Mimecast.URL.disableLogClick
      description: If logging of user clicks on the URL is disabled.
      type: string
    - contextPath: Mimecast.URL.matchType
      description: Either explicit - applies to the full URL or domain - applies to all URL values in the domain.
      type: string
    - contextPath: Mimecast.URL.ID
      description: The Mimecast secure ID of the managed URL.
      type: string
    - contextPath: Mimecast.URL.disableRewrite
      description: If rewriting of this URL in emails is disabled.
      type: boolean
  - arguments:
    - description: The email address to return the message list for.
      name: mailbox
    - description: The start date of messages to return, in the following format, 2015-11-16T14:49:18+0000. Default is the last calendar month.
      name: startTime
    - description: The end date of messages to return, in the following format, 2015-11-16T14:49:18+0000. Default is the end of the current day.
      name: endTime
    - auto: PREDEFINED
      defaultValue: INBOX
      description: 'The message list type, must be one of: inbox or sent, default is inbox.'
      name: view
      predefined:
      - INBOX
      - SENT
    - description: Filter by message subject.
      name: subject
    - defaultValue: '100'
      description: The maximum number of results to return.
      name: limit
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    description: Get a list of messages for a given user. This is an archive search command.
    name: mimecast-list-messages
    outputs:
    - contextPath: Mimecast.Message.Subject
      description: Message Subject.
      type: string
    - contextPath: Mimecast.Message.ID
      description: Message ID.
      type: string
    - contextPath: Mimecast.Message.Size
      description: The size of the message in bytes.
      type: number
    - contextPath: Mimecast.Message.RecievedDate
      description: The date the message was received.
      type: date
    - contextPath: Mimecast.Message.From
      description: The mail Sender.
      type: string
    - contextPath: Mimecast.Message.AttachmentCount
      description: The number of attachments on the message.
      type: string
  - arguments:
    - description: The number of results to request. Default is all.
      name: resultsNumber
    - description: Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day.
      name: fromDate
    - description: End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request.
      name: toDate
    - auto: PREDEFINED
      defaultValue: malicious
      description: Filters logs by scan result, default is malicious.
      name: resultType
      predefined:
      - safe
      - malicious
      - timeout
      - error
      - unsafe
      - all
    - defaultValue: '100'
      description: The maximum number of results to return.
      name: limit
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    description: Returns Attachment Protect logs for a Mimecast customer account.
    name: mimecast-get-attachment-logs
    outputs:
    - contextPath: Mimecast.AttachmentLog.Result
      description: 'The result of the attachment analysis: clean, malicious, unknown, or timeout.'
      type: string
    - contextPath: Mimecast.AttachmentLog.Date
      description: The time at which the attachment was released from the sandbox.
      type: date
    - contextPath: Mimecast.AttachmentLog.Sender
      description: The sender of the attachment.
      type: string
    - contextPath: Mimecast.AttachmentLog.FileName
      description: The file name of the original attachment.
      type: string
    - contextPath: Mimecast.AttachmentLog.Action
      description: The action triggered for the attachment.
      type: string
    - contextPath: Mimecast.AttachmentLog.Recipient
      description: The address of the user that received the attachment.
      type: string
    - contextPath: Mimecast.AttachmentLog.FileType
      description: The file type of the attachment.
      type: string
    - contextPath: Mimecast.AttachmentLog.Route
      description: 'The route of the original email containing the attachment, either: inbound, outbound, internal, or external.'
      type: string
  - arguments:
    - description: This parameter is ignored, use the 'limit' parameter instead.
      name: resultsNumber
    - description: Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day.
      name: fromDate
    - description: End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request.
      name: toDate
    - auto: PREDEFINED
      defaultValue: malicious
      description: Filters logs by scan result.
      name: resultType
      predefined:
      - clean
      - malicious
      - all
    - defaultValue: '100'
      description: The maximum number of results to return.
      name: limit
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    description: Returns URL protect logs for a Mimecast customer account. Default value of scanResult as malicious.
    name: mimecast-get-url-logs
    outputs:
    - contextPath: Mimecast.UrlLog.Category
      description: The category of the URL clicked.
      type: string
    - contextPath: Mimecast.UrlLog.UserAddress
      description: The email address of the user who clicked the link.
      type: string
    - contextPath: Mimecast.UrlLog.URL
      description: The url clicked.
      type: string
    - contextPath: Mimecast.UrlLog.Awareness
      description: The action taken by the user if user awareness was applied.
      type: string
    - contextPath: Mimecast.UrlLog.AdminOverride
      description: The action defined by the administrator for the URL.
      type: string
    - contextPath: Mimecast.UrlLog.Date
      description: The date that the URL was clicked.
      type: date
    - contextPath: Mimecast.UrlLog.Result
      description: The result of the URL scan.
      type: string
    - contextPath: Mimecast.UrlLog.Action
      description: The action that was taken for the click.
      type: string
    - contextPath: Mimecast.UrlLog.Route
      description: 'The route of the original email containing the attachment, either: inbound, outbound, internal, or external.'
      type: string
    - contextPath: Mimecast.UrlLog. userOverride
      description: The action requested by the user.
      type: string
  - arguments:
    - description: The number of results to request. Default is all.
      name: resultsNumber
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Filters for messages tagged malicious (true) or not tagged malicious (false). Omit for no tag filtering. Default is true.'
      name: taggedMalicious
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: The field to search. Default is all (meaning all of the preceding fields).
      name: searchField
      predefined:
      - senderAddress
      - recipientAddress
      - subject
      - policy
      - all
    - description: Required if searchField exists. A character string to search for in the logs.
      name: query
    - auto: PREDEFINED
      description: Filters logs by identifiers, can include any of newly_observed_domain, internal_user_name, repy_address_mismatch, and targeted_threat_dictionary. you can choose more then one identifier separated by comma.
      isArray: true
      name: identifiers
      predefined:
      - newly_observed_domain
      - internal_user_name
      - repy_address_mismatch
      - targeted_threat_dictionary
    - description: Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day.
      name: fromDate
    - description: End date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is time of request.
      name: toDate
    - auto: PREDEFINED
      description: Filters logs by action, you can choose more then one action separated by comma.
      isArray: true
      name: actions
      predefined:
      - delete
      - hold
      - bounce
      - smart_folder
      - disable_smart_folder
      - content_expire
      - meta_expire
      - stationery
      - gcc
      - secure_delivery
      - delivery_route
      - document_policy
      - disable_document_policy
      - attach_set_policy
      - remove_email
    - defaultValue: '100'
      description: The maximum number of results to return.
      name: limit
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    description: Returns Impersonation Protect logs for a Mimecast customer account.
    name: mimecast-get-impersonation-logs
    outputs:
    - contextPath: Mimecast.Impersonation.ResultCount
      description: The total number of IMPERSONATION log lines found for the request.
      type: number
    - contextPath: Mimecast.Impersonation.Hits
      description: The number of identifiers that the message triggered.
      type: number
    - contextPath: Mimecast.Impersonation.Malicious
      description: Whether the message was tagged as malicious.
      type: boolean
    - contextPath: Mimecast.Impersonation.SenderIP
      description: The source IP address of the message.
      type: string
    - contextPath: Mimecast.Impersonation.SenderAddress
      description: The email address of the sender of the message.
      type: string
    - contextPath: Mimecast.Impersonation.Subject
      description: The subject of the email.
      type: string
    - contextPath: Mimecast.Impersonation.Identifiers
      description: 'The properties of the message that triggered the action: similar_internal_domain, newly_observed_domain, internal_user_name, reply_address_mismatch, and/or targeted_threat_dictionary.'
      type: string
    - contextPath: Mimecast.Impersonation.Date
      description: The time at which the log was recorded.
      type: date
    - contextPath: Mimecast.Impersonation.Action
      description: 'The action triggered by the email.'
      type: string
    - contextPath: Mimecast.Impersonation.Policy
      description: The name of the policy definition that triggered the log.
      type: string
    - contextPath: Mimecast.Impersonation.ID
      description: Impersonation Log ID.
      type: string
    - contextPath: Mimecast.Impersonation.RecipientAddress
      description: The email address of the recipient of the email.
      type: string
    - contextPath: Mimecast.Impersonation.External
      description: Whether the message was tagged as coming from an external address.
      type: boolean
  - arguments:
    - description: URL to decode.
      name: url
      required: true
    description: Decodes a given url from mimecast.
    name: mimecast-url-decode
    outputs:
    - contextPath: URL.Data
      description: The encoded url to parse.
      type: string
    - contextPath: URL.Mimecast.DecodedURL
      description: Parsed url.
      type: string
  - description: discover authentication types that are supported for your account and which base URL to use for the requesting user.
    name: mimecast-discover
    outputs:
    - contextPath: Mimecast.Authentication.AuthenticationTypes
      description: List of authentication types available to the user.
      type: string
    - contextPath: Mimecast.Authentication.EmailAddress
      description: Email address of the request sender.
      type: string
    - contextPath: Mimecast.Authentication.EmailToken
      description: Email token of the request sender.
      type: string
  - description: Refresh access key validity.
    name: mimecast-refresh-token
  - description: Login to generate Access Key and  Secret Key.
    name: mimecast-login
  - arguments:
    - description: Message ID.
      name: messageID
      required: true
    - auto: PREDEFINED
      description: 'Defines which copy of the message part to return, must be one of: "delivered" the copy that has been processed by the Mimecast MTA with policies such as URL rewriting applied, OR "received" - the copy of the message that Mimecast originally received. (Only relevant for part argument = message or all).'
      name: context
      predefined:
      - DELIVERED
      - RECEIVED
      required: true
    - description: The email address of the mailbox to search. Required when context is DELIVERED.
      name: mailbox
    - auto: PREDEFINED
      defaultValue: PLAIN
      description: The message type to return. (Only relevant for part argument = message or all).
      name: type
      predefined:
      - HTML
      - PLAIN
      - RFC822
      - TRANSMISSION_MESSAGE_BODY
    - auto: PREDEFINED
      defaultValue: all
      description: Define what message part to return - download message, get metadata or both.
      name: part
      predefined:
      - message
      - metadata
      - all
    description: Get the contents or metadata of a given message. This is an archive search command.
    name: mimecast-get-message
    outputs:
    - contextPath: Mimecast.Message.ID
      description: Message ID.
      type: string
    - contextPath: Mimecast.Message.Subject
      description: The message subject.
      type: string
    - contextPath: Mimecast.Message.HeaderDate
      description: The date of the message as defined in the message headers.
      type: date
    - contextPath: Mimecast.Message.Size
      description: The message size.
      type: number
    - contextPath: Mimecast.Message.From
      description: Sender of the message as defined in the message header.
      type: string
    - contextPath: Mimecast.Message.To.EmailAddress
      description: Recipient of the message.
      type: string
    - contextPath: Mimecast.Message.ReplyTo
      description: The value of the Reply-To header.
      type: string
    - contextPath: Mimecast.Message.CC.EmailAddress
      description: Each CC recipient of the message.
      type: string
    - contextPath: Mimecast.Message.EnvelopeFrom
      description: Sender of the message as defined in the message envelope.
      type: string
    - contextPath: Mimecast.Message.Headers.Name
      description: Header's name.
      type: string
    - contextPath: Mimecast.Message.Headers.Values
      description: Header's value.
      type: string
    - contextPath: Mimecast.Message.Attachments.FileName
      description: Message attachment's file name.
      type: string
    - contextPath: Mimecast.Message.Attachments.SHA256
      description: Message attachment's SHA256.
      type: string
    - contextPath: Mimecast.Message.Attachments.ID
      description: Message attachment's ID.
      type: string
    - contextPath: Mimecast.Message.Attachments.Size
      description: Message attachment's file size.
      type: number
    - contextPath: Mimecast.Message.Attachments.Extension
      description: Message attachment's file extension.
      type: string
    - contextPath: Mimecast.Message.Processed
      description: The date the message was processed by Mimecast in ISO 8601 format.
      type: date
    - contextPath: Mimecast.Message.HasHtmlBody
      description: If the message has an HTML body part.
      type: boolean
    - contextPath: File.Size
      description: File Size.
      type: number
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Name
      description: The sample name.
      type: string
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: War-Room Entry ID of the file.
      type: string
    - contextPath: File.Info
      description: Basic information of the file.
      type: string
    - contextPath: File.Type
      description: File type e.g., "PE".
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - description: The Mimecast ID of the message attachment to return. (Can be retrieved from mimecast-get-message).
      name: attachmentID
      required: true
    - description: The Mimecast attachment name. When used, the file name and its extension will be included in the context data. Can be retrieved from mimecast-get-message command.
      name: attachmentName
      required: false
    description: Download attachments from a specified message. This is an archive search command.
    name: mimecast-download-attachments
    outputs:
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Name
      description: The sample name.
      type: string
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: War-Room Entry ID of the file.
      type: string
    - contextPath: File.Info
      description: Basic information of the file.
      type: string
    - contextPath: File.Type
      description: File type e.g., "PE".
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - description: The string to query.
      name: query_string
    - auto: PREDEFINED
      description: The group source by which to filter.
      name: query_source
      predefined:
      - cloud
      - ldap
    - description: The maximum number of results to return.
      name: limit
    description: Returns the list of groups according to the specified query.
    name: mimecast-find-groups
    outputs:
    - contextPath: Mimecast.Group.Name
      description: The name of the group.
      type: String
    - contextPath: Mimecast.Group.Source
      description: The source of the group.
      type: String
    - contextPath: Mimecast.Group.ID
      description: The Mimecast ID of the group.
      type: String
    - contextPath: Mimecast.Group.NumberOfUsers
      description: The number of members in the group.
      type: Number
    - contextPath: Mimecast.Group.ParentID
      description: The Mimecast ID of the group's parent.
      type: String
    - contextPath: Mimecast.Group.NumberOfChildGroups
      description: The number of child groups.
      type: Number
  - arguments:
    - description: The group ID to return. Can be retrieved by running the mimecast-find-groups command.
      name: group_id
      required: true
    - description: The maximum number of results to return. Default value is 100.
      name: limit
    - auto: PREDEFINED
      description: Whether to retrieve all results.
      defaultValue: "false"
      predefined:
      - "true"
      - "false"
      name: all_results
    description: Returns the members list for the specified group.
    name: mimecast-get-group-members
    outputs:
    - contextPath: Mimecast.Group.Users.Name
      description: The user's display name.
      type: String
    - contextPath: Mimecast.Group.Users.EmailAddress
      description: The user's email address.
      type: String
    - contextPath: Mimecast.Group.Users.Domain
      description: The domain name of the user's email address.
      type: String
    - contextPath: Mimecast.Group.Users.Type
      description: The user type.
      type: String
    - contextPath: Mimecast.Group.Users.InternalUser
      description: Whether the user is internal.
      type: Boolean
    - contextPath: Mimecast.Group.Users.IsRemoved
      description: Whether the user is part of the group.
      type: Boolean
    - contextPath: Mimecast.Group.Users.Notes
      description: The notes linked to the group.
      type: unknown
  - arguments:
    - description: The group ID to add the user to. Can be retrieved by running the mimecast-find-groups command.
      name: group_id
      required: true
    - description: The email address of the user to add to a group.
      name: email_address
    - description: A domain to add to a group.
      name: domain_address
    - description: The notes for the entry.
      name: notes
    description: Adds a user to a group. The email_address and domain_address arguments are optional, but one of them must be supplied.
    name: mimecast-add-group-member
    outputs:
    - contextPath: Mimecast.Group.Users.EmailAddress
      description: The user's email address.
      type: String
    - contextPath: Mimecast.Group.Users.IsRemoved
      description: Whether the user is part of the group.
      type: Boolean
  - arguments:
    - description: The group ID from which to remove the user. Can be retrieved by running the mimecast-find-groups command.
      name: group_id
      required: true
    - description: The email address of the user to remove from the group.
      name: email_address
    - description: A domain of the user to remove from a group.
      name: domain_address
    description: Removes a user from a group. The email_address and domain_address arguments are optional, but one of them must be supplied.
    name: mimecast-remove-group-member
    outputs:
    - contextPath: Mimecast.Group.Users.EmailAddress
      description: The user's email address.
      type: String
    - contextPath: Mimecast.Group.Users.IsRemoved
      description: Whether the user part of the group.
      type: Boolean
  - arguments:
    - description: The name of the new group.
      name: group_name
      required: true
    - description: The Mimecast ID of the new group's parent. Default will be root level. Can be retrieved by running the mimecast-find-groups command.
      name: parent_id
    description: Creates a new Mimecast group.
    name: mimecast-create-group
    outputs:
    - contextPath: Mimecast.Group.Name
      description: The name of the group.
      type: String
    - contextPath: Mimecast.Group.Source
      description: The source of the group.
      type: String
    - contextPath: Mimecast.Group.ID
      description: The Mimecast ID of the group.
      type: String
    - contextPath: Mimecast.Group.NumberOfUsers
      description: The number of members in the group.
      type: Number
    - contextPath: Mimecast.Group.ParentID
      description: The Mimecast ID of the group's parent.
      type: String
    - contextPath: Mimecast.Group.NumberOfChildGroups
      description: The number of child groups.
      type: Number
  - arguments:
    - description: The new name for the group.
      name: group_name
    - description: The Mimecast ID of the group to update.
      name: group_id
      required: true
    - description: The new parent group.
      name: parent_id
    description: Updates an existing Mimecast group.
    name: mimecast-update-group
    outputs:
    - contextPath: Mimecast.Group.Name
      description: The name of the group.
      type: String
    - contextPath: Mimecast.Group.ID
      description: The Mimecast ID of the group.
      type: String
    - contextPath: Mimecast.Group.ParentID
      description: The Mimecast ID of the group's parent.
      type: String
  - arguments:
    - description: The file hash or messageId value.
      name: hash_message_id
      required: true
    - description: The reason for creating the remediation incident.
      name: reason
      required: true
    - auto: PREDEFINED
      description: The message component by which to search. Default is "hash".
      name: search_by
      predefined:
      - hash
      - messageId
    - description: 'The start date of messages to remediate. Default value is the previous month. (Format: yyyy-mm-ddThh:mm:ss+0000).'
      name: start_date
    - description: 'The end date of messages to remediate. Default value is the end of the current day. (Format: yyyy-mm-ddThh:mm:ss+0000).'
      name: end_date
    description: Creates a new Mimecast remediation incident.
    name: mimecast-create-remediation-incident
    outputs:
    - contextPath: Mimecast.Incident.ID
      description: The secure Mimecast remediation ID.
      type: String
    - contextPath: Mimecast.Incident.Code
      description: The incident code generated at creation.
      type: String
    - contextPath: Mimecast.Incident.Type
      description: The incident type.
      type: String
    - contextPath: Mimecast.Incident.Reason
      description: The reason provided at the creation of the remediation incident.
      type: String
    - contextPath: Mimecast.Incident.IdentifiedMessages
      description: The number of messages identified based on the search criteria.
      type: Number
    - contextPath: Mimecast.Incident.SuccessfullyRemediatedMessages
      description: The number successfully remediated messages.
      type: Number
    - contextPath: Mimecast.Incident.FailedRemediatedMessages
      description: The number of messages that failed to remediate.
      type: Number
    - contextPath: Mimecast.Incident.MessagesRestored
      description: The number of messages that were restored from the incident.
      type: Number
    - contextPath: Mimecast.Incident.LastModified
      description: The date and time that the incident was last modified.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.From
      description: The sender email address or domain.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.To
      description: The recipient email address or domain.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.MessageID
      description: The message ID used when creating the remediation incident.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.FileHash
      description: The file hash used when creating the remediation incident.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.StartDate
      description: The start date of included messages.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.EndDate
      description: The end date of included messages.
      type: String
  - arguments:
    - description: The Mimecast ID for a remediation incident.
      name: incident_id
      required: true
    description: Returns a Mimecast remediation incident.
    name: mimecast-get-remediation-incident
    outputs:
    - contextPath: Mimecast.Incident.ID
      description: The secure Mimecast remediation ID.
      type: String
    - contextPath: Mimecast.Incident.Code
      description: The incident code generated at creation.
      type: String
    - contextPath: Mimecast.Incident.Type
      description: The incident type.
      type: String
    - contextPath: Mimecast.Incident.Reason
      description: The reason provided when the remediation incident was created.
      type: String
    - contextPath: Mimecast.Incident.IdentifiedMessages
      description: The number of messages identified based on the search criteria.
      type: Number
    - contextPath: Mimecast.Incident.SuccessfullyRemediatedMessages
      description: The number of successfully remediated messages.
      type: Number
    - contextPath: Mimecast.Incident.FailedRemediatedMessages
      description: The number of messages that failed to remediate.
      type: Number
    - contextPath: Mimecast.Incident.MessagesRestored
      description: The number of messages that were restored from the incident.
      type: Number
    - contextPath: Mimecast.Incident.LastModified
      description: The date and time that the incident was last modified.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.From
      description: The sender email address or domain.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.To
      description: The recipient email address or domain.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.MessageID
      description: The message ID used when creating the remediation incident.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.FileHash
      description: The file hash used when creating the remediation incident.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.StartDate
      description: The start date of included messages.
      type: String
    - contextPath: Mimecast.Incident.SearchCriteria.EndDate
      description: The end date of included messages.
      type: String
  - arguments:
    - description: List of file hashes to check if they were seen in an account.
      isArray: true
      name: hashes_to_search
      required: true
    description: Searches for one or more file hashes in the account. Maximum is 100.
    name: mimecast-search-file-hash
    outputs:
    - contextPath: Mimecast.Hash.HashValue
      description: The file hash value.
      type: String
    - contextPath: Mimecast.Hash.Detected
      description: Whether the hash was found in the account.
      type: Boolean
  - arguments:
    - description: The ID of the policy to update.
      name: policy_id
      required: true
    - description: A new description for the policy.
      name: description
    - auto: PREDEFINED
      description: The sender type by which to block senders in the policy. This argument must match the fromValue argument. For example, if you specify email_domain, the fromValue must be an email domain.
      name: fromType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      - free_mail_domains
      - header_display_name
    - auto: PREDEFINED
      description: The blocked receiver type by which to block receivers in the policy. This argument must match the toValue argument. For example, if you specify email_domain, the fromType must be an email domain.
      name: toType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - individual_email_address
    - auto: PREDEFINED
      description: The block action.
      name: option
      predefined:
      - no_action
      - block_sender
    - description: The value of the fromType argument. For example, if you specify email_domain for fromType, the fromValue must be an email domain.
      name: fromValue
    - description: The value of the toType argument. For example, if you specify email_domain for toType, the toValue must be an email domain.
      name: toValue
    - auto: PREDEFINED
      description: The part from where addresses are pulled.
      name: fromPart
      predefined:
      - envelope_from
      - header_from
      - both
    description: Deprecated. Use mimecast-update-block-sender-policy instead.
    name: mimecast-update-policy
    outputs:
    - contextPath: Mimecast.Policy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.Policy.Sender.Address
      description: Block sender by email address value.
      type: string
    - contextPath: Mimecast.Policy.Sender.Domain
      description: Block sender by domain value.
      type: string
    - contextPath: Mimecast.Policy.Sender.Group
      description: Block sender by group value.
      type: string
    - contextPath: Mimecast.Policy.Bidirectional
      description: Whether the blocked policy is bidirectional.
      type: boolean
    - contextPath: Mimecast.Policy.Receiver.Address
      description: Block emails to receiver type address.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Domain
      description: Block emails to receiver type domain.
      type: string
    - contextPath: Mimecast.Policy.Receiver.Group
      description: Block emails to receiver type group.
      type: string
    - contextPath: Mimecast.Policy.Fromdate
      description: The policy validation start date.
      type: date
    - contextPath: Mimecast.Policy.Todate
      description: The policy expiration date.
      type: date
    - contextPath: Mimecast.Policy.Sender.Type
      description: The sender type.
      type: String
    - contextPath: Mimecast.Policy.Receiver.Type
      description: The receiver type.
      type: String
    deprecated: true
  - name: mimecast-search-message
    description: Searches a message.
    arguments:
    - name: search_reason
      description: Reason for tracking the email.
      defaultValue: ""
      predefined:
      - ""
    - name: from_date
      description: API start parameter. Datetime format is ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: to_date
      description: API end parameter  Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: message_id
      description: The internet message ID of the message to track.
      defaultValue: ""
      predefined:
      - ""
    - name: from
      description: "Part of advancedTrackAndTraceOptions object: The sending email address or domain of the messages to track."
      defaultValue: ""
      predefined:
      - ""
    - name: to
      description: "Part of advancedTrackAndTraceOptions object: The recipient email address or domain of the messages to track."
      defaultValue: ""
      predefined:
      - ""
    - name: subject
      description: "Part of advancedTrackAndTraceOptions object: The subject of the messages to track."
      defaultValue: ""
      predefined:
      - ""
    - name: sender_ip
      description: "Part of advancedTrackAndTraceOptions object: The source IP address of the messages to track."
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: route
      description: A comma-separated list of routes to filter by.
      isArray: true
      defaultValue: ""
      predefined:
      - internal
      - outbound
      - inbound
    outputs:
    - contextPath: Mimecast.SearchMessage.info
      description: Info regarding the message.
      type: String
    - contextPath: Mimecast.SearchMessage.id
      description: The Mimecast ID of the message. Used to load more information about the message.
      type: String
    - contextPath: Mimecast.SearchMessage.status
      description: The status of the message.
      type: String
    - contextPath: Mimecast.SearchMessage.fromEnv.emailAddress
      description: The email address of the sender.
      type: String
    - contextPath: Mimecast.SearchMessage.fromHdr.displayableName
      description: The display name of the recipient.
      type: String
    - contextPath: Mimecast.SearchMessage.fromHdr.emailAddress
      description: The email address of the recipient.
      type: String
    - contextPath: Mimecast.SearchMessage.to.displayableName
      description: The display name of the recipient.
      type: String
    - contextPath: Mimecast.SearchMessage.to.emailAddress
      description: The email address of the recipient.
      type: String
    - contextPath: Mimecast.SearchMessage.received
      description: The date and time the message was received by Mimecast.
      type: Date
    - contextPath: Mimecast.SearchMessage.subject
      description: The subject of the message.
      type: String
    - contextPath: Mimecast.SearchMessage.senderIP
      description: The source IP address of the message.
      type: String
    - contextPath: Mimecast.SearchMessage.attachments
      description: If the message has attachments.
      type: Boolean
    - contextPath: Mimecast.SearchMessage.route
      description: The route of the message.
      type: String
    - contextPath: Mimecast.SearchMessage.sent
      description: The date and time that the message was sent / processed by Mimecast.
      type: Date
    - contextPath: Mimecast.SearchMessage.spamScore
      description: Spam score of the email.
      type: Number
    - contextPath: Mimecast.SearchMessage.detectionLevel
      description: Detection level of the email.
      type: String
  - name: mimecast-get-message-info
    description: Retrieves detailed information about a specific message.
    arguments:
    - name: ids
      description: A comma-separated list of the Mimecast IDs of the messages to load. This is returned by the /api/message-finder/search endpoint. (mimecast-search-message command).
      required: true
      isArray: true
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: show_recipient_info
      description: When argument is true all data from recipientInfo object is presented at command response.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      name: show_delivered_message
      description: When argument is true all data from deliveredMessage object is presented at command response.
      defaultValue: "false"
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      name: show_retention_info
      description: When argument is true all data from retentionInfo object is presented at command response.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      name: show_spam_info
      description: When argument is true all spamInfo block is presented at command response.
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.extension
      description: Component extension type.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.hash
      description: Component hash.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.mimeType
      description: Component MIME type.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.name
      description: Component name.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.size
      description: Component size.
      type: Number
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.components.type
      description: Component type.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.deliveryEvent
      description: Description of delivery event.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.emailAddress
      description: Email address of recipient.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.encryptionInfo
      description: Encryption type.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.messageExpiresIn
      description: Expiration time of message.
      type: Number
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.processingServer
      description: Processing server address.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.receiptAcknowledgement
      description: Recipient acknowledgement.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteHost
      description: Remote host address.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteIp
      description: Remote IP address.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.remoteServerGreeting
      description: Remote server greeting.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionEnd
      description: Transmission end date.
      type: Date
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionSize
      description: Transmission size.
      type: Number
    - contextPath: Mimecast.MessageInfo.deliveredMessage.deliveryMetaInfo.transmissionStart
      description: Transmission start date.
      type: Date
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.fromEnvelope
      description: Sender mail. (From envelope).
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.fromHeader
      description: Sender mail. (From header).
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.processed
      description: Processed time and date.
      type: Date
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.route
      description: Message route.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.sent
      description: Message sent time and date.
      type: Date
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.subject
      description: Message subject.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.to
      description: Recipients info.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.messageInfo.transmissionInfo
      description: Transmission info.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.policyInfo.inherited
      description: Whether policy is inherited.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.deliveredMessage.policyInfo.policyName
      description: Policy name.
      type: String
    - contextPath: Mimecast.MessageInfo.deliveredMessage.policyInfo.policyType
      description: Policy type.
      type: String
    - contextPath: Mimecast.MessageInfo.id
      description: Message ID.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.binaryEmailSize
      description: Email size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.extension
      description: Component extension type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.hash
      description: Component hash.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.mimeType
      description: Component MIME type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.name
      description: Component name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.size
      description: Component size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.components.type
      description: Component type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.encryptionInfo
      description: Encryption information.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.fromEnvelope
      description: The routable email address (From envelope).
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.fromHeader
      description: The routable email address (From header).
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.messageExpiresIn
      description: Expiry time of message.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.processed
      description: Message processed time.
      type: Date
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.processingServer
      description: Message processing server.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.receiptAcknowledgement
      description: Recipient acknowledgement.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.receiptEvent
      description: Receipt event name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.remoteHost
      description: Remote host address.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.remoteIp
      description: Remote IP address.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.remoteServerGreeting
      description: Remote server greeting.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.sent
      description: Message send time and date.
      type: Date
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.spamEvent
      description: Spam event name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.subject
      description: Message subject.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.to
      description: Recipient info.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionEnd
      description: Transmission end date.
      type: Date
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionInfo
      description: Transmission info.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionSize
      description: Transmission size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.messageInfo.transmissionStart
      description: Transmission start date.
      type: Date
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.binaryEmailSize
      description: Email size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.extension
      description: Component extension type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.hash
      description: Component hash type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.mimeType
      description: Component MIME type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.name
      description: Component name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.size
      description: Component size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.components.type
      description: Component type.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.encryptionInfo
      description: Encryption information.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.messageExpiresIn
      description: Expiration time of message.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.processingServer
      description: Processing server address.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.receiptAcknowledgement
      description: Recipient acknowledgement.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.receiptEvent
      description: Receipt event name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteHost
      description: Remote host address.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteIp
      description: Remote IP address.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.remoteServerGreeting
      description: Remote server greeting.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.spamEvent
      description: Spam event name.
      type: String
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionEnd
      description: Transmission end date.
      type: Date
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionSize
      description: Transmission size.
      type: Number
    - contextPath: Mimecast.MessageInfo.recipientInfo.recipientMetaInfo.transmissionStart
      description: Transmission start date.
      type: Date
    - contextPath: Mimecast.MessageInfo.retentionInfo.currentPurgeDate
      description: Current purge date and time.
      type: Date
    - contextPath: Mimecast.MessageInfo.retentionInfo.originalPurgeDate
      description: Original purge date and time.
      type: Date
    - contextPath: Mimecast.MessageInfo.retentionInfo.purgeBasedOn
      description: Value that purge is based on.
      type: String
    - contextPath: Mimecast.MessageInfo.retentionInfo.retentionAdjustmentDays
      description: Retention adjustment days.
      type: Number
    - contextPath: Mimecast.MessageInfo.spamInfo.detectionLevel
      description: Spam detection level.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.dkim.allow
      description: Is DomainKeys Identified Mail (DKIM) allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.dkim.info
      description: DKIM info.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.dmarc.allow
      description: Is Domain-based Message Authentication, Reporting & Conformance (DMARC) allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.dmarc.info
      description: DMARC info.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.greyEmail
      description: Is grey email allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.managedSender.allow
      description: Is Managed Sender allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.managedSender.info
      description: Managed Sender info.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.permittedSender.allow
      description: Is Permitted Sender allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.permittedSender.info
      description: Permitted Sender info.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.rbl.allow
      description: Is Real-time blackhole list (RBL) allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.rbl.info
      description: RBL info.
      type: String
    - contextPath: Mimecast.MessageInfo.spamInfo.spamScore
      description: Spam score.
      type: Number
    - contextPath: Mimecast.MessageInfo.spamInfo.spf.allow
      description: Is Sender Policy Framework (SPF) allowed.
      type: Boolean
    - contextPath: Mimecast.MessageInfo.spamInfo.spf.info
      description: SPF info.
      type: String
    - contextPath: Mimecast.MessageInfo.status
      description: Message status.
      type: String
  - name: mimecast-list-held-message
    description: Get information about held messages, including the reason, hold level, sender and recipients.
    arguments:
    - auto: PREDEFINED
      name: admin
      description: Whether only results for the currently authenticated user will be returned.
      defaultValue: "false"
      predefined:
      - "true"
      - "false"
    - name: from_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: to_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: value
      description: Free text to filter results by.
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: field_name
      description: Message fields to filter based on.
      defaultValue: ""
      predefined:
      - all
      - subject
      - sender
      - recipient
      - reasonCode
      - senderIP
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: limit
      description: The maximum number of results to return.
      defaultValue: ""
      predefined:
      - ""
    outputs:
    - contextPath: Mimecast.HeldMessage.dateReceived
      description: The timestamp of the message transmission.
      type: Date
    - contextPath: Mimecast.HeldMessage.from.displayableName
      description: The sender name.
      type: String
    - contextPath: Mimecast.HeldMessage.from.emailAddress
      description: The sender email.
      type: String
    - contextPath: Mimecast.HeldMessage.fromHeader.displayableName
      description: The display name of the sender (From header).
      type: String
    - contextPath: Mimecast.HeldMessage.fromHeader.emailAddress
      description: The email address of the sender (From header).
      type: String
    - contextPath: Mimecast.HeldMessage.hasAttachments
      description: Returns true if the message contains attachments. False indicates no attachments.
      type: Boolean
    - contextPath: Mimecast.HeldMessage.id
      description: The Mimecast secure ID for a message.
      type: String
    - contextPath: Mimecast.HeldMessage.policyInfo
      description: Information or definition name triggering the message hold action.
      type: String
    - contextPath: Mimecast.HeldMessage.reason
      description: The summary reason for holding the message.
      type: String
    - contextPath: Mimecast.HeldMessage.reasonCode
      description: Reason code for holding the message.
      type: String
    - contextPath: Mimecast.HeldMessage.reasonId
      description: Mirrors the reason field, formatted without spaces. However, reasonCode should be used instead.
      type: String
    - contextPath: Mimecast.HeldMessage.route
      description: "Direction of message being held. Possible values are: INBOUND, OUTBOUND, INTERNAL, EXTERNAL."
      type: String
    - contextPath: Mimecast.HeldMessage.size
      description: The size of the message in bytes.
      type: Number
    - contextPath: Mimecast.HeldMessage.subject
      description: The message subject.
      type: String
    - contextPath: Mimecast.HeldMessage.to.displayableName
      description: The display name of the recipient.
      type: String
    - contextPath: Mimecast.HeldMessage.to.emailAddress
      description: The email address of the recipient.
      type: String
  - name: mimecast-held-message-summary
    description: Get counts of currently held messages for each hold reason.
    arguments: []
    outputs:
    - contextPath: Mimecast.HeldMessageSummary.numberOfItems
      description: The number of messages currently held for this reason.
      type: Number
    - contextPath: Mimecast.HeldMessageSummary.policyInfo
      description: The name of the policy or definition that held a message.
      type: String
  - name: mimecast-reject-held-message
    description: Reject a currently held message.
    arguments:
    - name: ids
      description: A comma-separated list of Mimecast secure IDs IDs are extracted from the mimecast-list-held-message command.
      required: true
      isArray: true
      defaultValue: ""
      predefined:
      - ""
    - name: message
      description: Rejection message to be returned to the sender.
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: reason_type
      description: User can choose reason.
      defaultValue: ""
      predefined:
      - MESSAGE CONTAINS UNDESIRABLE CONTENT,MESSAGE CONTAINS CONFIDENTIAL INFORMATION,REVIEWER DISAPPROVES OF CONTENT.
      - INAPPROPRIATE COMMUNICATIONMESSAGE GOES AGAINST EMAIL POLICIES
      - ""
    - auto: PREDEFINED
      name: notify
      description: Whether to deliver rejection notificationd.
      defaultValue: ""
      predefined:
      - "true"
      - "false"
    outputs: []
  - name: mimecast-release-held-message
    description: Release a currently held message.
    arguments:
    - name: id
      description: Mimecast secure ID. ID can be extracted from the mimecast-list-held-message command.
      required: true
      defaultValue: ""
      predefined:
      - ""
    outputs: []
  - name: mimecast-search-processing-message
    description: Return messages currently being processed by Mimecast. Note that most of the time, no results are returned.
    arguments:
    - auto: PREDEFINED
      name: sort_order
      description: The method used to sort the messages.
      defaultValue: ""
      predefined:
      - asc
      - desc
    - name: from_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: to_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      defaultValue: ""
      predefined:
      - ""
    - name: value
      description: The search value to be used.
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: field_name
      description: The field to be searched.
      defaultValue: ""
      predefined:
      - ALL
      - fromAddress
      - toAddress
      - subject
      - info
      - remoteIp
    - name: attachments
      description: The presence of an attachment in the message.
      defaultValue: ""
      predefined:
      - ""
    - auto: PREDEFINED
      name: route
      description: The message route.
      defaultValue: ""
      predefined:
      - all
      - internal
      - outbound
      - inbound
      - external
    - name: page_size
      description: Number of results per page to display.
      defaultValue: ""
      predefined:
      - ""
    - name: page
      description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      defaultValue: ""
      predefined:
      - ""
    - name: limit
      description: The maximum number of results to return.
      defaultValue: ""
      predefined:
      - ""
    outputs:
    - contextPath: Mimecast.ProcessingMessage.messages.id
      description: The Mimecast secure ID of the message.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.fromEnv.emailAddress
      description: The routable email address (From evelope).
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.fromHeader.emailAddress
      description: The routable email address (From header).
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.to.emailAddress
      description: The routable email address.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.subject
      description: The message subject.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.attachment
      description: Whether there is an attachment in the message.
      type: Boolean
    - contextPath: Mimecast.ProcessingMessage.messages.routing
      description: The directional route of the message. Possible values are internal, outbound, inbound or external.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.size
      description: The size of the message in bytes.
      type: Number
    - contextPath: Mimecast.ProcessingMessage.messages.remoteIp
      description: The connecting IP address.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.attempts
      description: The number of processing attempts of the message.
      type: Number
    - contextPath: Mimecast.ProcessingMessage.messages.nextAttempt
      description: The date of the next process attempt for the message.
      type: Date
    - contextPath: Mimecast.ProcessingMessage.messages.created
      description: The date of the processing request creation.
      type: Date
    - contextPath: Mimecast.ProcessingMessage.messages.info
      description: Current processing status of the message.
      type: String
    - contextPath: Mimecast.ProcessingMessage.messages.priority
      description: Message priority.
      type: String
  - name: mimecast-list-email-queues
    description: Get the count of the inbound and outbound email queues at specified times.
    arguments:
    - name: from_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      required: true
      defaultValue: ""
      predefined:
      - ""
    - name: to_date
      description: Datetime format ISO 8601. e.g., 2022-07-11T14:49:18+0000.
      required: true
      defaultValue: ""
      predefined:
      - ""
    outputs:
    - contextPath: Mimecast.EmailQueue.inboundEmailQueue.count
      description: The number of inbound messages currently queued.
      type: Number
    - contextPath: Mimecast.EmailQueue.inboundEmailQueue.date
      description: The date for the displayed number of messages.
      type: Date
    - contextPath: Mimecast.EmailQueue.outboundEmailQueue.count
      description: The number of outbound messages currently queued.
      type: Number
    - contextPath: Mimecast.EmailQueue.outboundEmailQueue.date
      description: The date for the displayed number of messages.
      type: Date
  - name: mimecast-get-archive-search-logs
    description: Retrieves archived search logs.
    arguments:
    - name: query
      description: Text to search within the logs, which can contain email addresses.
    - name: page
      description: Page number for pagination.
    - name: page_size
      description: Number of items per page for pagination. Default value is '50'.
    - name: limit
      description: The maximum number of items to return.
      defaultValue: 50
    outputs:
    - contextPath: Mimecast.ArchiveSearchLog.logs.createTime
      description: The time that the search was executed.
      type: Date
    - contextPath: Mimecast.ArchiveSearchLog.logs.emailAddr
      description: The email address of the user who performed the search.
      type: String
    - contextPath: Mimecast.ArchiveSearchLog.logs.source
      description: The source of the search.
      type: String
    - contextPath: Mimecast.ArchiveSearchLog.logs.searchText
      description: The text used in the search.
      type: String
    - contextPath: Mimecast.ArchiveSearchLog.logs.searchReason
      description: The reason for the search.
      type: String
    - contextPath: Mimecast.ArchiveSearchLog.logs.description
      description: The description of the search if any.
      type: String
  - name: mimecast-get-search-logs
    description: Retrieves the search logs.
    arguments:
    - name: query
      description: Text to search within the logs, which can contain email addresses.
    - name: start
      description: The earliest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the start of the current day.
      defaultValue: now
    - name: end
      description: The latest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the end of the current day.
      defaultValue: now
    - name: page
      description: Page number for pagination.
    - name: page_size
      description: Number of items per page for pagination. Default value is '50'.
    - name: limit
      description: The maximum number of items to return.
      defaultValue: 50
    outputs:
    - contextPath: Mimecast.SearchLog.meta.pagination.pageSize
      description: 'The number of results per page.'
      type: Number
    - contextPath: Mimecast.SearchLog.meta.pagination.totalCount
      description: 'The total number of search results.'
      type: Number
    - contextPath: Mimecast.SearchLog.meta.pagination.next
      description: 'A link to the next page of search results.'
      type: String
    - contextPath: Mimecast.SearchLog.meta.status
      description: 'The status code of the search operation.'
      type: Number
    - contextPath: Mimecast.SearchLog.createTime
      description: 'The time that the search was executed.'
      type: Date
    - contextPath: Mimecast.SearchLog.emailAddr
      description: 'The email address of the user who performed the search.'
      type: String
    - contextPath: Mimecast.SearchLog.source
      description: 'The source context of the search.'
      type: String
    - contextPath: Mimecast.SearchLog.searchText
      description: 'The text used in the search.'
      type: String
    - contextPath: Mimecast.SearchLog.searchPath
      description: 'The search path used in the search.'
      type: String
    - contextPath: Mimecast.SearchLog.searchReason
      description: 'The reason entered when the search was executed.'
      type: String
    - contextPath: Mimecast.SearchLog.isAdmin
      description: 'Indicates if the search was an admin search or not.'
      type: Boolean
    - contextPath: Mimecast.SearchLog.museQuery
      description: '(Deprecated) The Mimecast search query used, if any.'
      type: String
    - contextPath: Mimecast.SearchLog.description
      description: 'The description of the search, if any.'
      type: String
  - name: mimecast-list-account
    description: This endpoint returns the summary details for an account in Mimecast.
    arguments:
    - name: account_name
      description: The account name.
    - name: account_code
      description: The unique Mimecast account code for the customer.
    - name: admin_email
      description: The email address of the first administrator created on the account.
    - name: region
      description: The region where the account is hosted.
    - name: user_count
      description: The number of user licenses on the account.
    - name: page
      description: Page number for pagination.
    - name: page_size
      description: Number of items per page for pagination. Default value is '50'.
    - name: limit
      description: The maximum number of items to return.
      defaultValue: 50
    outputs:
    - contextPath: Mimecast.Account.region
      description: 'The region where the account is hosted.'
      type: String
    - contextPath: Mimecast.Account.archive
      description: 'If archiving features are enabled on the account.'
      type: Boolean
    - contextPath: Mimecast.Account.gateway
      description: 'If gateway features are enabled on the account.'
      type: Boolean
    - contextPath: Mimecast.Account.passphrase
      description: 'The passphrase set on the account, used by Mimecast Support when verifying callers during support calls.'
      type: String
    - contextPath: Mimecast.Account.supportCode
      description: 'The support code.'
      type: String
    - contextPath: Mimecast.Account.maxRetention
      description: 'The maximum retention in days configured for the account.'
      type: Number
    - contextPath: Mimecast.Account.maxRetentionConfirmed
      description: 'If the maximum retention value on the account has been confirmed.'
      type: Boolean
    - contextPath: Mimecast.Account.minRetentionEnabled
      description: 'If minimum retention is enabled on the account.'
      type: Boolean
    - contextPath: Mimecast.Account.automatedSegmentPurge
      description: 'If purging of expired storage segments is enabled on the account.'
      type: Boolean
    - contextPath: Mimecast.Account.type
      description: 'The type of account.'
      type: String
    - contextPath: Mimecast.Account.policyInheritance
      description: 'If policy inheritance is enabled on the account.'
      type: Boolean
    - contextPath: Mimecast.Account.databaseCode
      description: 'The database code.'
      type: String
    - contextPath: Mimecast.Account.searchReason
      description: 'The search reason.'
      type: Boolean
    - contextPath: Mimecast.Account.contentAdministratorDefaultView
      description: 'The content administrator default view.'
      type: String
    - contextPath: Mimecast.Account.adminSessionTimeout
      description: 'The admin session timeout.'
      type: Number
    - contextPath: Mimecast.Account.exportApi
      description: 'If the export API is enabled.'
      type: Boolean
    - contextPath: Mimecast.Account.exgestAllowQuery
      description: 'If the exgest allows queries.'
      type: Boolean
    - contextPath: Mimecast.Account.exgestAllowExtraction
      description: 'If the exgest allows extraction.'
      type: Boolean
    - contextPath: Mimecast.Account.expressAccount
      description: 'If the account is an express account.'
      type: Boolean
    - contextPath: Mimecast.Account.cybergraphV2Enabled
      description: 'If Cybergraph v2 is enabled.'
      type: Boolean
    - contextPath: Mimecast.Account.accountCode
      description: 'The unique Mimecast account code for the customer.'
      type: String
    - contextPath: Mimecast.Account.accountName
      description: 'The account name.'
      type: String
    - contextPath: Mimecast.Account.adminEmail
      description: 'The email address of the first administrator created on the account.'
      type: String
    - contextPath: Mimecast.Account.contactEmail
      description: 'The contact email address.'
      type: String
    - contextPath: Mimecast.Account.domain
      description: 'The temporary domain name added to the account. This name is generated by Mimecast and is only used for initial access to the account. It should not be used for email routing.'
      type: String
    - contextPath: Mimecast.Account.userCount
      description: 'The number of user licenses on the account.'
      type: Number
    - contextPath: Mimecast.Account.mimecastId
      description: 'The unique Mimecast ID of the account.'
      type: String
    - contextPath: Mimecast.Account.contactName
      description: 'The contact name.'
      type: String
    - contextPath: Mimecast.Account.telephone
      description: 'The telephone number.'
      type: Date
    - contextPath: Mimecast.Account.packages
      description: 'An array of packages enabled on the customer account.'
      type: String
  - name: mimecast-get-view-logs
    description: Retrieves the email view logs.
    arguments:
    - name: query
      description: Text to search within the logs, which can contain email addresses.
    - name: start
      description: The earliest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the start of the current day.
      defaultValue: now
    - name: end
      description: The latest search log to return in the following format 2017-09-16T14:49:18+0000. Defaults to the end of the current day.
      defaultValue: now
    - name: page
      description: Page number for pagination.
    - name: page_size
      description: Number of items per page for pagination. Default value is '50'.
    - name: limit
      description: The maximum number of items to return.
      defaultValue: 50
    outputs:
    - contextPath: Mimecast.ViewLog.viewer
      description: 'The email address of the user who viewed the message.'
      type: String
    - contextPath: Mimecast.ViewLog.source
      description: 'The source of the message.'
      type: String
    - contextPath: Mimecast.ViewLog.viewed
      description: 'The date and time that the message was viewed.'
      type: Date
    - contextPath: Mimecast.ViewLog.from
      description: 'The sender of the viewed message.'
      type: String
    - contextPath: Mimecast.ViewLog.to
      description: 'The recipient of the viewed message.'
      type: String
    - contextPath: Mimecast.ViewLog.subject
      description: 'The subject of the viewed message.'
      type: String
    - contextPath: Mimecast.ViewLog.messageDate
      description: 'The date and time that the message was received.'
      type: Date
    - contextPath: Mimecast.ViewLog.contentViewed
      description: 'Indicates if the message content was viewed or not.'
      type: Boolean
    - contextPath: Mimecast.ViewLog.discoveryCase
      description: 'Whether the viewed message is a part of an existing discovery case.'
      type: Boolean
  - name: mimecast-create-block-sender-policy
    description: 'Creates a blocked sender policy. This command does not set context outputs, use mimecast-get-policy to retrieve the full policy.'
    execution: true
    arguments:
    - description: Policy description.
      name: description
      required: true
    - auto: PREDEFINED
      defaultValue: envelope_from
      description: Addresses based on.
      name: fromPart
      predefined:
      - envelope_from
      - header_from
      - both
      required: true
    - auto: PREDEFINED
      description: Blocked sender type.
      name: fromType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - description: 'Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address. For address_attribute_value, use the from_attribute_id and from_attribute_value arguments instead.'
      name: fromValue
    - description: The secure ID of the address attribute. Required if fromType is address_attribute_value.
      name: from_attribute_id
    - description: The value to which the address attribute is equal. Required if fromType is address_attribute_value.
      name: from_attribute_value
    - auto: PREDEFINED
      description: The receiver type.
      name: toType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - description: 'Required if toType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address. For address_attribute_value, use the to_attribute_id and to_attribute_value arguments instead.'
      name: toValue
    - description: The secure ID of the address attribute. Required if toType is address_attribute_value.
      name: to_attribute_id
    - description: The value to which the address attribute is equal. Required if toType is address_attribute_value.
      name: to_attribute_value
    - auto: PREDEFINED
      description: The block option.
      name: option
      predefined:
      - no_action
      - block_sender
      required: true
    - description: The policy start date in ISO 8601 format (e.g., 2024-01-15T12:34:56Z).
      name: from_date
    - description: The policy end date in ISO 8601 format (for example, 2024-01-15T12:34:56Z).
      name: to_date
    outputs:
    - contextPath: Mimecast.BlockedSendersPolicy.id
      description: The ID of the newly created blocked senders policy.
      type: String
  - name: mimecast-update-block-sender-policy
    description: 'Updates an existing blocked senders policy. Only the fields you explicitly provide are sent to the API and updated, while fields you omit are left unchanged on the server. This command does not set context outputs, use mimecast-get-policy to retrieve the updated policy.'
    execution: true
    arguments:
    - description: The ID of the policy to update.
      name: policy_id
      required: true
    - description: A new description for the policy.
      name: description
    - auto: PREDEFINED
      description: The sender type by which to block senders in the policy. For email_domain, profile_group, and individual_email_address, provide the value in the fromValue argument. For address_attribute_value, provide the values in the from_attribute_id and from_attribute_value arguments instead. The everyone, internal_addresses, and external_addresses types require no value.
      name: fromType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
    - auto: PREDEFINED
      description: The blocked receiver type by which to block receivers in the policy. For email_domain, profile_group, and individual_email_address, provide the value in the toValue argument. For address_attribute_value, provide the values in the to_attribute_id and to_attribute_value arguments instead. The everyone, internal_addresses, and external_addresses types require no value.
      name: toType
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
    - auto: PREDEFINED
      description: The block action.
      name: option
      predefined:
      - no_action
      - block_sender
    - description: The value of the fromType argument. For example, if you specify email_domain for fromType, the fromValue must be an email_domain. For address_attribute_value, use the from_attribute_id and from_attribute_value arguments instead.
      name: fromValue
    - description: The value of the toType argument. For example, if you specify email_domain for toType, the toValue must be an email_domain. For address_attribute_value, use the to_attribute_id and to_attribute_value arguments instead.
      name: toValue
    - description: The secure ID of the address attribute. Required if fromType is address_attribute_value.
      name: from_attribute_id
    - description: The value to which the address attribute is equal. Required if fromType is address_attribute_value.
      name: from_attribute_value
    - description: The secure ID of the address attribute. Required if toType is address_attribute_value.
      name: to_attribute_id
    - description: The value to which the address attribute is equal. Required if toType is address_attribute_value.
      name: to_attribute_value
    - auto: PREDEFINED
      description: The part from where addresses are pulled.
      name: fromPart
      predefined:
      - envelope_from
      - header_from
      - both
    - description: The policy start date in ISO 8601 format (e.g., 2024-01-15T12:34:56Z).
      name: from_date
    - description: The policy end date in ISO 8601 format (for example, 2024-01-15T12:34:56Z).
      name: to_date
  - name: mimecast-list-policies
    description: List all existing Mimecast blocked sender policies.
    arguments:
    - name: policyType
      description: According to this argument an endpoint is selected.
      defaultValue: blockedsenders
      auto: PREDEFINED
      predefined:
      - blockedsenders
      - antispoofing-bypass
      - address-alteration
    - name: page
      description: The page number you would like to view. Each page contains page_size values. Must be used with page_size. Not supported when policyType is blockedsenders.
    - name: page_size
      description: Sets the result to start returning results. Default value is '50'.
    - name: limit
      description: The maximum number of results to return.
      defaultValue: 50
    - name: next_token
      description: Pagination token for requesting the next page. Only applicable when policyType is blockedsenders.
    outputs:
    - contextPath: Mimecast.BlockedSendersPolicy.policies
      description: The list of blocked-senders policies returned for the current page.
      type: Unknown
    - contextPath: Mimecast.BlockedSendersPolicy.NextToken
      description: The pagination token for the next page of blocked-senders policies.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.ID
      description: Policy ID.
      type: string
    - contextPath: Mimecast.AddressAlterationPolicy.meta.status
      description: The status of the Address Alteration policy.
      type: Number
    - contextPath: Mimecast.AddressAlterationPolicy.addressAlterationSetId
      description: The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.id
      description: The Mimecast secure ID of the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.description
      description: The description for the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromPart
      description: Should the sender address be considered based on the envelope, header, or either address.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.from.type
      description: The type of sender address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.to.type
      description: The type of recipient address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromType
      description: The sender address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toType
      description: The recipient address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromEternal
      description: Should the policy start to apply, regardless of the current date and time, for the sender address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toEternal
      description: Should the policy start to apply, regardless of the current date and time, for the recipient address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromDate
      description: The start date that the policy should begin to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toDate
      description: The end date that the policy should cease to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.override
      description: Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.bidirectional
      description: Should the policy also apply in reverse email flow.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.conditions
      description: Conditions of the sending platform to determine if the policy should be considered.
      type: Unknown
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enabled
      description: Should the policy be considered for emails processing through Mimecast.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enforced
      description: Is the policy enforced.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.createTime
      description: The creation timestamp of the policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.lastUpdated
      description: Block emails to receiver type.
      type: string
    - contextPath: Mimecast.BlockedSendersPolicy.policies.id
      description: 'The unique identifier of the blocked senders policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.description
      description: 'The description of the blocked senders policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.from.type
      description: 'The sender address type considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.from.emailAddress
      description: 'The sender email address considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.from.domain
      description: 'The sender domain considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.from.groupId
      description: 'The sender profile group ID considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.to.type
      description: 'The recipient address type considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.to.emailAddress
      description: 'The recipient email address considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.to.domain
      description: 'The recipient domain considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.to.groupId
      description: 'The recipient profile group ID considered by the policy.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.bidirectional
      description: 'Whether the policy also applies in reverse email flow.'
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.policies.fromDateTime
      description: 'The date and time the policy starts to apply.'
      type: Date
    - contextPath: Mimecast.BlockedSendersPolicy.policies.toDateTime
      description: 'The date and time the policy ceases to apply.'
      type: Date
    - contextPath: Mimecast.BlockedSendersPolicy.policies.fromEternal
      description: 'Whether the policy applies regardless of the start date.'
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.policies.toEternal
      description: 'Whether the policy applies regardless of the end date.'
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.policies.fromPart
      description: 'Whether the sender address is considered based on the envelope, header, or either address.'
      type: String
    - contextPath: Mimecast.BlockedSendersPolicy.policies.enabled
      description: 'Whether the policy is enabled.'
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.policies.enforced
      description: 'Whether the policy is enforced.'
      type: Boolean
    - contextPath: Mimecast.BlockedSendersPolicy.policies.override
      description: 'Whether the policy is considered prior to other policies of the same type.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.option
      description: 'The option for the antispoofing bypass policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.id
      description: 'The unique identifier for the antispoofing bypass policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.description
      description: 'A description of the antispoofing bypass policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromPart
      description: 'The part of the email address or domain from which the policy is applied.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.from.type
      description: 'The type of sender address or domain for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.from.emailDomain
      description: 'The email domain of the sender for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.to.type
      description: 'The type of recipient address or domain for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.to.emailDomain
      description: 'The email domain of the recipient for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromType
      description: 'The type of sender for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromValue
      description: 'The value of the sender for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toType
      description: 'The type of recipient for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toValue
      description: 'The value of the recipient for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromEternal
      description: 'Indicates whether the policy applies indefinitely to the sender.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toEternal
      description: 'Indicates whether the policy applies indefinitely to the recipient.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromDate
      description: 'The start date from which the policy is effective.'
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toDate
      description: 'The end date until which the policy is effective.'
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.override
      description: 'Indicates whether the policy overrides other policies.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.bidirectional
      description: 'Indicates whether the policy applies in both directions.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.conditions.spfDomains
      description: 'The SPF domains condition for the policy.'
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enabled
      description: 'Indicates whether the policy is enabled.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enforced
      description: 'Indicates whether the policy is enforced.'
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.createTime
      description: 'The date and time when the policy was created.'
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.lastUpdated
      description: 'The date and time when the policy was last updated.'
      type: Date
  - name: mimecast-create-antispoofing-bypass-policy
    description: Create a new Anti-Spoofing SPF based Bypass policy.
    arguments:
    - name: option
      description: The policy action to be taken.
      auto: PREDEFINED
      predefined:
      - disable_bypass
      - enable_bypass
      required: true
    - name: bidirectional
      description: Determines if the policy should apply in both email directions, where the sender and recipient configurations are reversed.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: comment
      description: Comment about the policy. This field is not visible within the Administration Console.
    - name: spf_domain
      description: Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation.
      required: true
    - name: description
      description: Narrative to describe the policy for future reference.
      required: true
    - name: enabled
      description: Determines if the policy should be enabled to process messages.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: enforced
      description: Determines if the policy enforcement option is enabled.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: no
    - name: from_attribute_id
      description: The secure ID of the address attribute.
    - name: from_attribute_name
      description: Name of address attribute.
    - name: from_attribute_value
      description: Value to which the address attribute is equal to.
    - name: from_date
      description: Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days ago". When specified, this will override the fromEternal value to false.
    - name: from_eternal
      description: Specifies if the policy should have no start date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: from_part
      description: Policy from part.
      auto: PREDEFINED
      predefined:
      - envelope_from
      - header_from
      - both
    - name: to_date
      description: Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days". When specified, this will override the toEternal value to false.
    - name: to_eternal
      description: Specifies if the policy should have no expiration date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: override
      description: Specifies if the policy should be set as an override. To be considered prior to equally-specific policies.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: from_type
      description: The scope for which the policy should should be applied.
      auto: PREDEFINED
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - name: from_value
      description: 'Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address.'
    - name: to_type
      description: The type of applies on.
      auto: PREDEFINED
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - name: to_value
      description: 'Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values :If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address.'
    outputs:
    - contextPath: Mimecast.AntispoofingBypassPolicy.data.option
      description: The action taken by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.id
      description: The ID of the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.description
      description: The description of the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromPart
      description: The part of the email message considered for the sender address by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.from.type
      description: The type of the sender address considered by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.to.type
      description: The type of the recipient address considered by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromType
      description: The sender address type considered by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toType
      description: The recipient address type considered by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromEternal
      description: Indicates if the sender address should always be considered, regardless of the current date and time, by the Antispoofing Bypass policy.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toEternal
      description: Indicates if the recipient address should always be considered, regardless of the current date and time, by the Antispoofing Bypass policy.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromDate
      description: The start date from which the Antispoofing Bypass policy should begin to apply.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toDate
      description: The end date until which the Antispoofing Bypass policy should apply.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.override
      description: Indicates if the Antispoofing Bypass policy should be applied prior to other policies of the same type, if conditions are met.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.bidirectional
      description: Indicates if the Antispoofing Bypass policy should also apply in reverse email flow.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.conditions.spfDomains
      description: The SPF domains considered by the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enabled
      description: Indicates if the Antispoofing Bypass policy should be considered for emails processing through Mimecast.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enforced
      description: Indicates if the Antispoofing Bypass policy is enforced.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.createTime
      description: The creation timestamp of the Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.lastUpdated
      description: The most recent modification timestamp of the Antispoofing Bypass policy.
      type: String
  - name: mimecast-update-antispoofing-bypass-policy
    description: Update an existing Anti-Spoofing SPF based Bypass policy.
    arguments:
    - name: description
      description: Narrative to describe the policy for future reference.
    - name: policy_id
      description: The Mimecast secure ID of an existing policy. Use /api/policy/antispoofing-bypass/get-policy to obtain the ID.
      required: true
    - name: enabled
      description: Determines if the policy should be enabled to process messages.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: from_date
      description: (yyyy-MM-dd'T'HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days". When specified, this will override the fromEternal value to false.
    - name: from_eternal
      description: Specifies if the policy should have no start date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: from_part
      description: Policy from part.
      auto: PREDEFINED
      predefined:
      - envelope_from
      - header_from
      - both
    - name: to_date
      description: Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days ago". When specified, this will override the toEternal value to false.
    - name: to_eternal
      description: Specifies if the policy should have no expiration date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: bidirectional
      description: Determines if the policy should apply in both email directions, where the sender and recipient configurations are reversed.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: option
      description: The policy action to be taken.
      required: true
      auto: PREDEFINED
      predefined:
      - disable_bypass
      - enable_bypass
    outputs:
    - contextPath: Mimecast.AntispoofingBypassPolicy.meta.status
      description: The status of the Mimecast Antispoofing Bypass policy.
      type: Number
    - contextPath: Mimecast.AntispoofingBypassPolicy.data.option
      description: The action taken by the Mimecast Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.id
      description: The Mimecast secure ID of the Address Alteration Set (folder) applied by the policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.description
      description: The description for the Mimecast Antispoofing Bypass policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromPart
      description: The part of the sender's address considered by the policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.from.type
      description: The sender address type (envelope or header).
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.to.type
      description: The recipient address type (envelope or header).
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromType
      description: The sender address type used by the policy (envelope_from, header_from, or both).
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toType
      description: The recipient address component scoped by the policy.
      type: String
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromEternal
      description: Determines if the policy applies regardless of the current date and time.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toEternal
      description: Determines if the policy continues to apply regardless of the current date and time.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.fromDate
      description: The start date for the policy to apply.
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.toDate
      description: The end date for the policy to cease application.
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.override
      description: Determines if the policy applies and takes precedence over other policies of the same type.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.bidirectional
      description: Determines if the policy applies to reverse email flow.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.conditions
      description: Conditions used to determine if the policy should be considered.
      type: Unknown
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enabled
      description: Determines if the policy is considered for emails processing through Mimecast.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.enforced
      description: Determines if the policy is enforced.
      type: Boolean
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.createTime
      description: The creation timestamp of the policy.
      type: Date
    - contextPath: Mimecast.AntispoofingBypassPolicy.policy.lastUpdated
      description: The most recent modification timestamp of the policy.
      type: Date
  - name: mimecast-create-address-alteration-policy
    description: This API endpoint can be used to create a new Address Alteration policy to apply an alteration definition based on sender and recipient values.
    arguments:
    - name: folder_id
      description: The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy. To provide this, run the mimecast-list-policies command and use the value from the `Mimecast.Policies.addressAlterationSetId` field.
      required: true
    - name: policy_description
      description: A description of the policies for future reference.
      required: true
    - name: bidirectional
      description: Determines if the policy should apply in both directions, where the from and to configurations are reversed.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: comment
      description: Comment about the policy. This field is not visible within the Administration Console.
    - name: conditions
      description: Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation.
    - name: enabled
      description: Determines if the policy should be enabled to process messages.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: enforced
      description: Determines if the policy enforcement option is enabled.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: no
    - name: from_date
      description: string (yyyy-MM-dd'T'HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days". When specified, this will override the fromEternal value to false.
    - name: from_eternal
      description: Specifies if the policy should have no start date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: from_part
      description: Policy from part.
      auto: PREDEFINED
      predefined:
      - envelope_from
      - header_from
      - both
    - name: to_date
      description: Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days". When specified, this will override the toEternal value to false.
    - name: to_eternal
      description: Specifies if the policy should have no expiration date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: override
      description: Specifies if the policy should be set as an override. To be considered prior to equally-specific policies.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: from_type
      description: The type of applies on.
      auto: PREDEFINED
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - name: to_type
      description: The type of applies on.
      auto: PREDEFINED
      predefined:
      - everyone
      - internal_addresses
      - external_addresses
      - email_domain
      - profile_group
      - address_attribute_value
      - individual_email_address
      required: true
    - name: from_value
      description: 'Required if fromType is one of email_domain, profile_group, individual_email_address. Expected values: If fromType is email_domain, a domain name without the @ symbol. If fromType is profile_group, the ID of the profile group. If fromType is individual_email_address, an email address.'
    - name: to_value
      description: 'Required if toType is one of email_domain, profile_group, individual_email_address. Expected values: If toType is email_domain, a domain name without the @ symbol. If toType is profile_group, the ID of the profile group. If toType is individual_email_address, an email address.'
    outputs:
    - contextPath: Mimecast.AddressAlterationPolicy.meta.status
      description: The status of the Address Alteration policy.
      type: Number
    - contextPath: Mimecast.AddressAlterationPolicy.addressAlterationSetId
      description: The Mimecast secure ID of the Address Alteration Set (folder) that will be applied by this policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.id
      description: The Mimecast secure ID of the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.description
      description: The description for the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromPart
      description: Should the sender address be considered based on the envelope, header, or either address.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.from.type
      description: The type of sender address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.to.type
      description: The type of recipient address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromType
      description: The sender address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toType
      description: The recipient address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromEternal
      description: Should the policy start to apply, regardless of the current date and time, for the sender address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toEternal
      description: Should the policy start to apply, regardless of the current date and time, for the recipient address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromDate
      description: The start date that the policy should begin to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toDate
      description: The end date that the policy should cease to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.override
      description: Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.bidirectional
      description: Should the policy also apply in reverse email flow.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.conditions
      description: Conditions of the sending platform to determine if the policy should be considered.
      type: Unknown
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enabled
      description: Should the policy be considered for emails processing through Mimecast.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enforced
      description: Is the policy enforced.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.createTime
      description: The creation timestamp of the policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.lastUpdated
      description: The most recent modification timestamp of the policy.
      type: String
  - name: mimecast-update-address-alteration-policy
    description: Update an existing Address Alteration policy.
    arguments:
    - name: policy_id
      description: The Mimecast secure ID of the Address Alteration policy to be modified.
      required: true
    - name: policy_description
      description: A description of the policies for future reference.
    - name: bidirectional
      description: Determines if the policy should apply in both directions, where the from and to configurations are reversed.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: comment
      description: Comment about the policy. This field is not visible within the Administration Console.
    - name: conditions
      description: Source IP ranges for a policy. It will only apply when the source IP address used to transmit the email data falls inside/matches the range(s) configured. IP ranges should be entered in CIDR notation.
    - name: enabled
      description: Determines if the policy should be enabled to process messages.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: enforced
      description: Determines if the policy enforcement option is enabled.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: no
    - name: from_date
      description: string (yyyy-MM-dd'T'HH:mm:ssZ) Specifies the date a policy should go into effect, in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days ago". When specified, this will override the fromEternal value to false.
    - name: from_eternal
      description: Specifies if the policy should have no start date.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      defaultValue: yes
    - name: from_part
      description: Policy from part.
      auto: PREDEFINED
      predefined:
      - envelope_from
      - header_from
      - both
    - name: to_date
      description: Specifies the expiration date of a policy in ISO 8601 format (e.g., 2015-11-16T14:49:18+0000) or a relative time such as "3 days ago". When specified, this will override the toEternal value to false.
    - name: to_eternal
      description: Specifies if the policy should have no expiration date.
      defaultValue: yes
      auto: PREDEFINED
      predefined:
      - yes
      - no
    - name: override
      description: Specifies if the policy should be set as an override. To be considered prior to equally-specific policies.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    outputs:
    - contextPath: Mimecast.AddressAlterationPolicy.meta.status
      description: The status of the Address Alteration policy.
      type: Number
    - contextPath: Mimecast.AddressAlterationPolicy.id
      description: The Mimecast secure ID of the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.description
      description: The description for the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromPart
      description: Should the sender address be considered based on the envelope, header, or either address.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.from.type
      description: The type of sender address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.to.type
      description: The type of recipient address considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromType
      description: The sender address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toType
      description: The recipient address type considered by the Address Alteration policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromEternal
      description: Should the policy start to apply, regardless of the current date and time, for the sender address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toEternal
      description: Should the policy start to apply, regardless of the current date and time, for the recipient address.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.fromDate
      description: The start date that the policy should begin to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.toDate
      description: The end date that the policy should cease to apply.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.override
      description: Should the policy be considered for application, and apply if conditions are met, prior to other policies of the same type.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.bidirectional
      description: Should the policy also apply in reverse email flow.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.conditions
      description: Conditions of the sending platform to determine if the policy should be considered.
      type: Unknown
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enabled
      description: Should the policy be considered for emails processing through Mimecast.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.enforced
      description: Is the policy enforced.
      type: Boolean
    - contextPath: Mimecast.AddressAlterationPolicy.policy.createTime
      description: The creation timestamp of the policy.
      type: String
    - contextPath: Mimecast.AddressAlterationPolicy.policy.lastUpdated
      description: The most recent modification timestamp of the policy.
      type: String
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.12042988
tests:
- Mimecast test
- Mimecast Test api 2.0
fromversion: 5.0.0
sectionorder:
- Connect
- Collect