Mimecast Cloud Gateway
Configure the Mimecast Cloud Gateway integration with RAD Security to ingest email threats.
This guide walks you through integrating Mimecast Cloud Gateway with RAD Security to ingest email threats for unified threat detection and investigation.
Mimecast Cloud Gateway protects your email against phishing, malware, and impersonation. RAD Security authenticates to the Mimecast API 2.0 using OAuth 2.0 client credentials and pulls email threat detections on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.
Read-only integration: RAD Security only reads data from Mimecast. It never writes to, modifies, or deletes anything in your Mimecast environment.
Mimecast Cloud Gateway provides email threats only — it does not provide email activity events. To also ingest email activity events, use the Microsoft Defender for Office 365 integration.
Prerequisites
Before you begin, ensure you have:
- A Mimecast account with API access
- Administrator permission to create an API 2.0 application in the Mimecast Administration Console
- An API 2.0 application entitled to the Threat Events API (
/threats/v1/events) — the resource RAD reads (see Step 1) - The API Gateway region for your Mimecast tenant (if not the default global region)
- Access to a RAD Security workspace with integration permissions
Understanding Integration Components
Step 1: Create an API 2.0 Application in Mimecast
Sign in to the Mimecast Administration Console
Log in to the Mimecast Administration Console with an administrator account that can manage API applications.
Create an API 2.0 Application
Navigate to Services → API and Platform Integrations and create a new Mimecast API 2.0 application. Provide the requested details and submit the application.
Generate Client Credentials
Generate the credentials for the application to obtain your Client ID and Client Secret.
Copy the Client Secret immediately. Mimecast shows the secret only once at creation time. Store it securely in a password manager or secrets vault.
Grant the Application Access to Threat Events
Confirm the application is assigned the product/permission that grants access to the Threat Events API (GET /threats/v1/events) — the only resource RAD reads. If this product is not provisioned on your Mimecast account, the credentials will authenticate but every data request is rejected (Mimecast returns 403 app_forbidden). Contact Mimecast support if Threat Events is not available to assign.
Determine Your API Gateway Region
Identify the API Gateway region for your Mimecast tenant. Use the default global region unless your tenant is served by a specific regional gateway.
Exact console navigation and labels vary across Mimecast versions. See the Mimecast API 2.0 documentation for current steps to create an application and generate credentials.
Configure in RAD Security
Navigate to your RAD Security workspace and configure the Mimecast Cloud Gateway integration with the following parameters:
Required Parameters
| Parameter | Description |
|---|---|
| Client ID | Mimecast API 2.0 OAuth2 Client ID |
| Client Secret | Mimecast API 2.0 OAuth2 Client Secret |
| API Gateway region | Mimecast API gateway region — optional, defaults to global |
Verify Integration
Check Connection Status
- Navigate to Data Sources > Integrations > Email Security in RAD Security
- Locate your Mimecast Cloud Gateway integration
- Verify the connection status shows as Connected
Your Mimecast integration is now configured! RAD Security will ingest email threats from Mimecast on a scheduled basis.
What Data is Synced
Use Cases
Threat Investigation Investigate Mimecast email threats with context from RAD runtime, cloud, and identity detections.
Correlated Detection Correlate Mimecast email threats with RAD runtime and identity signals to cut through the noise.
RADBot Prioritization Leverage RADBot to prioritize Mimecast email threats by real-world impact.
Unified Findings Review Mimecast email threats alongside the rest of your RAD security findings.
Troubleshooting
Security Best Practices
Use a Dedicated Application Create a dedicated API 2.0 application for the RAD integration rather than reusing an existing one.
Least Privilege Grant only the read access required for email threats.
Rotate Credentials Rotate the Client Secret periodically according to your security policy.
Secure Secret Storage Store the Client Secret in a secrets vault. Never commit it to version control.
Additional Resources
Mimecast API 2.0 Documentation
Official Mimecast API 2.0 documentation, including applications and credentials
Email Security Overview
Learn about RAD's email security integrations