In this section:
Feedback:

Mimecast 1.0

Note: Mimecast API 1.0 is scheduled for End of Life by end of 2026. See the official Mimecast notice for more information.

Anomali supports the ingestion of Mimecast logs through the Mimecast API 1.0 and AWS S3.

API 1.0 call

You can use your existing Mimecast Access and Secret Keys or create them to add a new log source in the Anomali platform.

Onboarding steps

Prerequisites

  1. Admin access to the Mimecast admin console.

  2. The admin must be assigned a role with read and edit API app permissions.

  3. Security permissions must permit the management of app roles.

Step 1: Retrieve custom App ID and App Key

To create a custom API app, see the Mimecast guide to Creating an API 2.0 application and follow the Version 1.0 Integration flow instead.

After creating the app, see the Mimecast console to retrieve the App ID and App Key. Securely store these details for the next steps.

Step 2: Create new user

You must create a user profile with the correct permissions to generate API keys for Mimecast collector authentication. To create a user:

  1. Sign into the admin console.

  2. Navigate to the Administration > Directories > Internal Directories to view a list of internal domains.

  3. Click the internal domain where you would like to create your new user.

  4. Click New Address and complete the form to create a new user.

  5. Keep a note of the email address and password. You will use them in Step 7: Create Access and Secret Keys.

Step 3: Add user to admin role

  1. Navigate to Administration > Account > Roles.

  2. Right-click the Basic Administrator role and click Add users to role.

  3. Select the new user you created.

  4. Click Add selected users.

Step 4: Create new user group

  1. Navigate to Administration > Directories > Profile Groups menu.

  2. Click the + icon on the parent folder where you would like to create the group. This creates a new group with the name New Folder.

  3. If you prefer renaming, click the group and use the text box to change the name.

  4. Navigate to Build > Add Email Addresses and enter the email address of the new user you created.

  5. Click Save and Exit.

Step 5: Create new authentication profile

  1. Navigate to Administration > Services > Applications menu.

  2. Click Authentication Profiles > New Authentication Profile.

  3. Enter a description for the new profile.

  4. Set the Authentication TTL setting to Never Expires. This ensures that your token does not expire, avoiding restrictive data collection.

  5. Leave other settings as default.

  6. Click Save and Exit.

Step 6: Create new app setting

  1. Navigate to Administration > Services > Applications menu.

  2. Click New Application Settings > New Authentication Profile to enter a description.

  3. In the Group field, paste the group you created.

  4. In the Authentication Profile field, select the authentication profile you created.

  5. Click Save and Exit.

Step 7: Create Access and Secret Keys

  1. Navigate to Administration > Services > API and Platform Integrations menu.

  2. Navigate to the Your Application Integrations tab.

  3. Click the application you created, then Create Keys.

  4. Enter the email address of the service account created in Step 2, then click Next.

  5. In the Authentication dialog popup, enter:

    1. Type: Cloud

    2. Password: Enter the user profile password you created.

  6. Click Next.

  7. If prompted, complete the multi-factor authentication.

  8. Click Next.

  9. Securely save the Access Key and Secret Key for Step 8: Add Mimecast as new log source.

Step 8: Add Mimecast as new log source

To add Mimecast as a new log source on the Anomali platform:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select Mimecast as the source type.

  6. Select API as the ingestion method.

  7. Select API as the ingest method.

  8. Provide the Basic Configuration details:

    1. App ID: Enter the application ID to authenticate requests.

    2. App Key: Enter the app key to authenticate requests.

    3. Access Key: Enter the access key to authenticate requests.

    4. Secret Key: Enter the secret key to authenticate requests.

    5. Admin Email Address: Email address for the service account provisioned for this integration.

      1. Important: The email address you specify here must be the email address associated with the service account access key provisioned for this integration.

    6. (Optional) TTP Attachment Logs: Select whether to collect these TTP attachment logs. Enabled by default.

    7. (Optional) TTP URL Logs: Select whether to collect these TTP URL logs. Enabled by default.

    8. (Optional) TTP Impersonation Logs: Select whether to collect these TTP impersonation logs. Enabled by default.

    9. (Optional) Threat Intel Feed: Select whether to collect these threat intel feed logs. Enabled by default.

    10. (Optional) Ingestion Interval: Specify a number of minutes, hours, or days between API requests.

  9. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.

    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  10. Click Save to add the log source.

Step 9: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 10: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 11: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.

AWS S3

If your logs are already in S3, you can proceed directly to Step 2: Create new user. If not, Anomali recommends following Step 1: Ship data to S3 using NXLog to use NXLog to first ship the logs to S3. After S3 receives the data, it sends updates to an Amazon SQS queue you designate, enabling Anomali to automatically pull the logs from S3 whenever it receives a new notification from the queue.

Onboarding Steps

Step 1: Ship data to S3 using NXLog

See Using NXLog to Ship Data to set up NXLog to send data into S3.

Step 2: Set up SQS queue

Once your data is in S3, you can send it to Anomali using Amazon SQS. See Setting up Amazon SQS queue for more information.

Step 3: Enable AWS S3 notifications

Enable AWS S3 notifications for Amazon SQS to receive change notifications when you add logs. See Amazon's guide to configuring AWS S3 notification for SQS for more information.

Step 4: Add Mimecast as new log source

On the Anomali platform, add Mimecast as a new log source, as follows:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select it as the log source.

  6. Select AWS S3 as the ingest method.

  7. Ensure S3 notification are enabled. See Step 2: Enable AWS S3 notifications for more information.

  8. Provide the Basic Configuration details:

    1. AWS SQS Queue URL: Enter the URL of your AWS SQS queue. See Setting up Amazon SQS queue for more information.

    2. AWS Secret Access Key: Provide the AWS secret access key.

    3. AWS Access Key ID: Enter the AWS Access ID.

    4. File Selector: Provide the path to the event log data files. Anomali recommends the following practices for the path:

          • Sourcetype must be the path prefix, as follows:
            <sourcetype>/year=2025/month=04/day=05/path/to/file.
            For example: mimecast/year=2025/month=03/day=22/events/event_data_logs/.
          • Sourcetype name must not contain any spaces: For example, "mimecast" or "mimecast_sourcetype" are correct, however "mimecast sourcetype" is incorrect.

  1. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.
    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  2. Click Save to add the log source.

Step 5: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 6: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 7: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.