AQUILA - Setup Integration from Mimecast
Mimecast Integration Guide
Integrate Mimecast with your security platform via API to collect email threat data, archive logs, DLP events, and other security-related logs for centralized visibility and incident response.
Credentials & API Access Setup (Mimecast)
Before configuring the integration, prepare your API credentials from the Mimecast Admin Console.
Steps:
-
Log in to the Mimecast Administration Console.
-
Navigate to Administration → Account → API Applications.
-
Click “Register New Application” and provide a name and description.
-
Once registered, take note of the following credentials:
-
Application ID
-
Application Key
-
Access Key
-
Secret Key
-
-
You may need your Mimecast Region-specific API URL:
-
Example:
https://api.mimecast.com -
Check with your Mimecast representative for region-specific URLs.
-
Note: Some log types may require separate credentials due to rate limits.
Permissions Reference (Mimecast API App)
Ensure the API Application and associated Access Key have the following scopes:
| Data Stream | Permission Scope |
|---|---|
| Archive / Audit Logs | auditevents:read |
| DLP & SIEM Logs | dlplogs:read, siemlogs:read |
| Threat Intel Feeds | ti_logs:read |
| TTP Logs | ttp_logs:read |
Integration Configuration (Mimecast)
| Data Stream | Required Details |
|---|---|
| Archive Search Logs | Application ID, App Key, Access Key, Secret Key, URL |
| Audit Events | Same as above |
| DLP Logs | Same as above |
| SIEM Logs | Same as above |
| Threat Intel Malware (Customer/Grid) | Same as above |
| TTP Logs (Attachment, URL, Impersonation) | Same as above |
Aquila Integration Configuration (Mimecast)
(incomplete)