Skip to main content

AQUILA - Mimecast API v2 Integration

Mimecast Integration Guide

Integrate Mimecast with your security platform via API to collect email threat data, archive logs, DLP events, and other security-related logs for centralized visibility and incident response.

API 2.0 is the current standard - It's been generally available for over a year and is what Mimecast recommends for new integrations

Credentials & API Access Setup (Mimecast)Mimecast API v2)

Before configuring the integration, prepare your API credentials from the Mimecast Admin Console.

StepsCreating an API 2.0 Application:

1.To Preparecreate Your Mimecastan API Credentials2.0 Application, follow the steps below:

    1. Follow these steps in the Mimecast Admin Console to generate the required credentials.

      • Log in to the Mimecast Administration Console

      • Navigate to Integrations | API and Platform Integrations
      • Locate the following Mimecast API 2.0 tile and click on Generate Keys.

    Mimecast1.png

        

    1. After reading the Terms & Conditions, complete the I accept check box to enable the Next button to progress onto the next step.

    2. Go

      Complete to:the AdministrationApplication →Details Account → API Applications

      section.

    Clickimage.png

    • We highly recommend creating a dedicated custom role with Registeronly Newthe permissions required for the Application

      to function.

    • Provide a name and description (e.g., "Log Integration for Aquila")

    • SaveSelect the application

      minimum set of Products the App needs to access to function.
    1. OnceShould registered,we noteneed theto followingcontact credentials:you
        regarding

      • Application ID

      • Application Key

      • Access Key

      • Secret Key

    2. Also, confirm your Mimecastthis API Baseapplication, URLplease provide details for a Technical Point of Contact.
      3. (region-specific).
      Examples:

    https://api.mimecast.com (US)image.png

  • https://au-api.mimecast.com (AU)

Note:Mimecast Some log types (like DLP or Threat Intel) may requirerecommends a separategroup Accessrather Keythan duean toindividual rate limits or limited scopes per API app.contact.

2.

    Required
  1. Review Fieldsthe Summary information for Integrationthe API application and click on Add if you are happy to proceed with creating the application.

image.png

     

  • Once     8. The wizard completes and displays a pop-up window including your Client ID and Client Secret key data, where you can copy and            save the credentials above gathered,for the following fields will be required during the integration:
    • API URL:application.

      Your

      image.png

      region’s

      Base URL (Mimecast API basev2)

      URL

      • To

    • Applicationtransition Key:from Fromyour thecurrent registeredAPI application
      • 1.0
    • Application ID: From the registered application
    • Access Key: From the account with log access
    • Secret Key: Secret tiedURLs to theAPI Access2.0, Key
      • we
    provide
    • three
API

3.gateway Accessoptions Keytailored Permissionsto &fulfill Scopeyour Behavior

performance,
  • In Mimecast, permission scopes are not manually assigned via the UI. Instead, they are automatically granted based on:

    • The rolecompliance, and privileges of the Mimecast user account that created the Access Key

    • The features enabled in your Mimecast subscription (e.g., SIEM, DLP, Threat Intelligence)

Note: Use a Mimecast Administrator account when generating the Access Key to ensure full access to all supported data streams.

residency

4. Additional Requirements for v2 API Endpoints (OAuth 2.0)

Some Mimecast log types may use v2 API endpoints, which require a different set of credentials using OAuth 2.0. Fom the same registered application, collect the following:requirements:

  • APIGlobal URL:URL: YourThe region’s Mimecastglobal API baseURL URLapi.services.mimecast.com which serves traffic from the nearest instance ensuring reduced latency and enhanced performance.
  • ClientUK ID:Instance URL: FromFor compliance and data residency requirements, customers can choose to process traffic via the registeredUK applicationinstance using the regional URL: uk-api.services.mimecast.com. This ensures API traffic is only processed within the UK instance of the Apigee Gateway.
  • ClientUS Secret:Instance URL: TiedSimilarly, customers with compliance or residency requirements in the US can use us-api.services.mimecast.com to process API traffic exclusively through the registeredUS Clientinstance IDof the Apigee Gateway.

These are required for integrations that rely on Mimecast’s OAuth 2.0 authorization flow.

Permissions Reference (Mimecast API App)

Ensure the API Application and associated Access Key have the following scopes:

failoverforhighNofailover
Data StreamFactor PermissionGlobal ScopeURLUK Instance URLUS Instance URL
ArchiveURL / Audit LogsDetails auditevents:readapi.services.mimecast.comuk-api.services.mimecast.comus-api.services.mimecast.com
DLP & SIEM LogsAvailability dlplogs:read,✅Auto siemlogs:read
Threat Intel Feedsuptime ti_logs:read
TTP- Logsrequests fail if UK instance is down ttp_logs:read No failover - requests fail if US instance is down

Aquila Integration Configuration

AQUILA – Mimecast Integration

1. Log in to AQUILA click here - CyTech - AQUILA. Choose Cyber Monitoring and click the small arrow icon to redirect you to the Cyber Monitoring Dashboard.

image.png

2. In the dashboard, choose Cyber Incident Management (SIEM and XDR).

image.png

3. Navigate through the top left icon and click the Collapse/Expand button.

image.png

4. Navigate the "Cyber Incident Monitoring" then hover the "Cyber Incident Management" till you see the settings.

image.png

5. Click the "Settings and Navigate through Settings>Log Source>Search Bar (Search the Source to Add)>Add to Agent.

image.png

6. Choose your Log Collector. (If you not yet installed your Log Collector please refer to this link - Log Collector Installation.)

image.png

7. In the integration settings follow the instructions given below.

  • Click the drop arrow to display the contents needed for the integration setup.

image.png

  • Upon clicking the drop arrow, it will display two versions of Mimecast Integration, v1 API and v2 API Endpoints.
  • This is for API v1 Endpoints. Input the required Fields:  API URL (Mimecast API base URL), Application Key, Application ID, Access Key, and Secret Key. 

image.png

  • This one is for API v2 Endpoints. Enter the required fields API URL (Mimecast API base URL), Client ID, and Client Secret.
  • Finally, click Next to install the log source integration.

image.png

8. Wait for the Successful window to display, this will confirm the successful integration.

image.png

If you need further assistance, kindly contact our support at support@cytechint.com for prompt assistance and guidance.

Back to top