SIEM: API - Mimecast

Team: Huntress Managed Security Information and Event Management (SIEM)
Product: Mimecast
Environment: Cloud
Summary: Learn how to configure Mimecast Enhanced Logging and connect Mimecast API 2.0 credentials to stream email security logs into Huntress Managed SIEM.

In this Article

What Gets Collected
Requirements
Configure Mimecast
Add Log Source
What to Expect After Setup
Verify Data Flow
Troubleshooting

What Gets Collected

Huntress collects Mimecast email security logs using the Mimecast API 2.0. When configured, Huntress polls Mimecast every five minutes and forwards events into your SIEM log view.

All events carry event.provider: Mimecast. Message-tracking fields (sender, recipients, subject, direction, attachments) and threat verdicts are normalized to ECS field names, and the full original event is retained under the mimecast.* prefix.

Requirements

Make sure you have the following prerequisites ready before starting setup:

• Mimecast Email Security Cloud Gateway.

• A Mimecast administrator account capable of creating API applications (a role with Read and Edit API Application Permissions under the Service Menu, and a Security Permissions setting that permits Management of Application Roles).

• Huntress Managed SIEM is active on your Huntress account. No additional enablement is needed on the Huntress side—Mimecast is available to every Managed SIEM account.

Configure Mimecast

Step 1: Enable Enhanced Logging in Mimecast

Important: Do this step first. The API returns data only for log types enabled here. If Enhanced Logging is turned off, Huntress connects successfully, reports no errors, and receives zero events.

1. Log in to the Mimecast Administration Console.

2. Go to Administration > Account > Account Settings.

3. Locate and select Enhanced Logging.

4. Enable the log types you want Huntress to collect.

5. Select Save.

Step 2: Create a Mimecast API 2.0 Application

1. Log in to the Mimecast Administration Console.

2. Go to Integrations > Integrations Hub.

3. If prompted, review and accept the Mimecast API Terms and Conditions.

4. Locate the Mimecast API 2.0 tile and select Configure New.

5. Enter the application details:

   • Application Name: Enter an identifiable name, such as Huntress SIEM. (This cannot be changed after saving.)

   • Products: Select Threats, Security Events, and Data. (This cannot be changed after saving.)

   • Application Role: Select a role that grants at least Security Events and Data Retrieval > Threat and Security Events (SIEM) > Read. Huntress recommends creating a custom role per application using least privilege. Roles are managed under Account > Admin Roles.

   • Description: Optional.

6. Under Notification Settings, enter a Technical Point of Contact and Email.

7. Select Save.

8. Copy the Client ID and Client Secret from the pop-up modal and store them securely.

Note: The secret is not shown again. If it is lost, use Reset Keys on the application to regenerate a new pair.

Note: If your API 2.0 application was created before Mimecast transitioned to the Integrations Hub, manage it under Integrations > API and Platform Integrations. New applications are managed only in the Integrations Hub.

Step 3: Identify Your Regional Gateway

Huntress needs to know which Mimecast regional gateway to call:

Select Global unless you have specific data-residency requirements. The UK and US gateways are pinned to a single region, so if that region is unavailable, log collection pauses until the service returns.

Add Log Source

Step 4: Add the Mimecast Source in Huntress

1. Log in to Huntress and go to SIEM > Source Management.

2. On the Configured Sources tab, select Add Source and choose Mimecast.

3. Enter the Client ID and Client Secret from Step 2, and select your region.

4. Save your changes.

Note: Mimecast also appears on the Source Catalog tab under Security Products, which opens the same configuration form.

Note: Huntress validates credentials upon saving. A failure indicates an invalid credential pair, missing SIEM Read permissions on the application, or a region mismatch with your tenant. A Mimecast source can be added at the account level or on an individual organization, depending on how you manage your tenant.

What to Expect After Setup

• Huntress polls Mimecast every five minutes.

• Mimecast batches logs into files roughly every 15 minutes, so most routine polls legitimately find no new events. This is expected behavior and not an error.

• Upon initial setup, Huntress reads up to seven days of available history. Because the API returns one log file per call, the initial backfill can take up to 24 hours before the source shows as fully current.

• Mimecast retains batch SIEM data for only 7 days. If the collection is interrupted for longer than seven days, missed events can't be recovered.

Verify Data is Flowing

In the SIEM log view, search for event.provider:Mimecast. To verify a specific log type, search using its corresponding event.dataset value from the table in the What Gets Collected section (for example, event.dataset:mimecast.receipt for inbound message receipt events).

Troubleshooting

The source connects, but no events arrive: 

Verify Enhanced Logging is enabled (Step 1). Log types disabled in Administration > Account > Account Settings > Enhanced Logging generate no data, causing the API to return empty results rather than an error. Confirm each log type is enabled and saved.

Credential validation fails on save: Check, in order:

1. The Client Secret was copied completely (use Reset Keys if unsure).

2. The application role grants Security Events and Data Retrieval > Threat and Security Events (SIEM) > Read.

3. The selected region matches your tenant.

Events stop arriving after working: 

Check whether the API application keys were regenerated or if the application was deleted in the Integrations Hub. Both invalidate stored credentials immediately. Re-enter the new Client ID and Client Secret on the Huntress source.

Only some log types appear: 

Each log type is enabled separately in Enhanced Logging. A log type enabled later streams events from that point forward, plus up to seven days of retained history.