Mimecast Modeling Rule

Details

ID	`Mimecast_modeling_rule`
From Version	6.8.0
To Version	6.9.9
Tags	mimecast

Rules (XIF)

[MODEL:model = Audit, dataset = mimecast_mimecast_raw]
filter xsiem_classifier = "audit_event"
| alter XDM.Audit.original_event_sub_type = category,
        XDM.Audit.event_timestamp = eventTime,
        XDM.Audit.original_event_description = eventInfo,
        XDM.Audit.original_event_type = auditType,
        XDM.Audit.TriggeredBy.identity.name = user,
        XDM.Audit.original_event_id = id;


[MODEL:model=Email, dataset=mimecast_mimecast_raw]
filter xsiem_classifier = "siem_log"
| alter XDM.Email.Observer.unique_identifier = acc,
        XDM.Email.original_event_id = aCode,
        XDM.Email.attachment.filename = AttNames,
        XDM.Email.event_timestamp = datetime,
        XDM.Email.Server.host.ipv4_addresses = json_extract_array(coalesce(IP,SourceIP), "$."),
        XDM.Email.message_id = MsgId,
        XDM.Email.recipients = json_extract_array(coalesce(Rcpt,Recipient), "$."),
        XDM.Email.sender = Sender,
        XDM.Email.subject = Subject,
        XDM.Email.threat.name = Virus,
        XDM.Email.attachment.extension = fileExt,
        XDM.Email.attachment.file_type = fileMime,
        XDM.Email.attachment.md5 = md5,
        XDM.Email.attachment.sha256 = sha256,
        XDM.Email.original_event_description = ScanResultInfo,
        XDM.Email.original_event_type = coalesce(Action, Act);

Schema

`mimecast_mimecast_raw`

Field	Type	Array?
`Act`	string	—
`Action`	string	—
`AttNames`	string	—
`IP`	string	Yes
`MsgId`	string	—
`Rcpt`	string	Yes
`Recipient`	string	Yes
`ScanResultInfo`	string	—
`Sender`	string	—
`SourceIP`	string	Yes
`Subject`	string	—
`Virus`	string	—
`aCode`	string	—
`acc`	string	—
`auditType`	string	—
`category`	string	—
`datetime`	datetime	—
`eventInfo`	string	—
`eventTime`	datetime	—
`fileExt`	string	—
`fileMime`	string	—
`id`	string	—
`md5`	string	—
`sha256`	string	—
`user`	string	—
`xsiem_classifier`	string	—

Raw JSON

{
    "mimecast_mimecast_raw": {
      "category": {
        "type": "string",
        "is_array": false
      },
      "eventTime": {
        "type": "datetime",
        "is_array": false
      },
      "eventInfo": {
        "type": "string",
        "is_array": false
      },
      "auditType": {
        "type": "string",
        "is_array": false
      },
      "user": {
        "type": "string",
        "is_array": false
      },
      "id": {
        "type": "string",
        "is_array": false
      },
      "acc": {
        "type": "string",
        "is_array": false
      },
      "aCode": {
        "type": "string",
        "is_array": false
      },
      "Act": {
        "type": "string",
        "is_array": false
      },
      "AttNames": {
        "type": "string",
        "is_array": false
      },
      "datetime": {
        "type": "datetime",
        "is_array": false
      },
      "IP": {
        "type": "string",
        "is_array": true
      },
      "MsgId": {
        "type": "string",
        "is_array": false
      },
      "Sender": {
        "type": "string",
        "is_array": false
      },
      "Subject": {
        "type": "string",
        "is_array": false
      },
      "Virus": {
        "type": "string",
        "is_array": false
      },
      "fileExt": {
        "type": "string",
        "is_array": false
      },
      "fileMime": {
        "type": "string",
        "is_array": false
      },
      "md5": {
        "type": "string",
        "is_array": false
      },
      "sha256": {
        "type": "string",
        "is_array": false
      },
      "SourceIP": {
        "type": "string",
        "is_array": true
      },
      "ScanResultInfo": {
        "type": "string",
        "is_array": false
      },
      "Action": {
        "type": "string",
        "is_array": false
      },
      "Rcpt": {
        "type": "string",
        "is_array": true
      },
      "Recipient": {
        "type": "string",
        "is_array": true
      },
      "xsiem_classifier": {
        "type": "string",
        "is_array": false
      }
    }
  }