> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Mimecast Cloud Gateway

> Configure the Mimecast Cloud Gateway integration with RAD Security to ingest email threats.

# Mimecast Cloud Gateway Integration Setup

This guide walks you through integrating Mimecast Cloud Gateway with RAD Security to ingest email threats for unified threat detection and investigation.

Mimecast Cloud Gateway protects your email against phishing, malware, and impersonation. RAD Security authenticates to the Mimecast API 2.0 using OAuth 2.0 client credentials and pulls email threat detections on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.

<Info>
  **Read-only integration:** RAD Security only reads data from Mimecast. It never writes to, modifies, or deletes anything in your Mimecast environment.
</Info>

<Note>
  Mimecast Cloud Gateway provides **email threats only** — it does not provide email activity events. To also ingest email activity events, use the [Microsoft Defender for Office 365 integration](/rad-security/integrations/email-security/defender-for-office-setup).
</Note>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * A Mimecast account with API access
  * Administrator permission to create an API 2.0 application in the Mimecast Administration Console
  * An API 2.0 application entitled to the **Threat Events** API (`/threats/v1/events`) — the resource RAD reads (see [Step 1](#step-1-create-an-api-2-0-application-in-mimecast))
  * The API Gateway region for your Mimecast tenant (if not the default global region)
  * Access to a RAD Security workspace with integration permissions
</Check>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="OAuth2 Client Credentials" icon="key">
    RAD Security authenticates to the Mimecast API 2.0 using the OAuth 2.0 client-credentials grant. You create an API 2.0 application in Mimecast and provide its **Client ID** and **Client Secret**. RAD exchanges them for short-lived access tokens automatically.
  </Accordion>

  <Accordion title="API Gateway Region" icon="globe">
    Mimecast operates regional API gateways. The optional **API Gateway region** selects the API base URL. Leave it at the default (**global**) unless your Mimecast tenant is served by a specific regional gateway.
  </Accordion>

  <Accordion title="Scheduled Polling" icon="clock">
    RAD Security ingests Mimecast data via scheduled polling. Webhooks are **not** used — data arrives on RAD's polling cadence rather than being pushed by Mimecast.
  </Accordion>
</AccordionGroup>

***

## Step 1: Create an API 2.0 Application in Mimecast

<Steps>
  <Step title="Sign in to the Mimecast Administration Console">
    Log in to the Mimecast Administration Console with an administrator account that can manage API applications.
  </Step>

  <Step title="Create an API 2.0 Application">
    Navigate to **Services → API and Platform Integrations** and create a new **Mimecast API 2.0** application. Provide the requested details and submit the application.
  </Step>

  <Step title="Generate Client Credentials">
    Generate the credentials for the application to obtain your **Client ID** and **Client Secret**.

    <Warning>
      Copy the **Client Secret** immediately. Mimecast shows the secret only once at creation time. Store it securely in a password manager or secrets vault.
    </Warning>
  </Step>

  <Step title="Grant the Application Access to Threat Events">
    Confirm the application is assigned the product/permission that grants access to the **Threat Events** API (`GET /threats/v1/events`) — the only resource RAD reads. If this product is not provisioned on your Mimecast account, the credentials will authenticate but every data request is rejected (Mimecast returns `403 app_forbidden`). Contact Mimecast support if Threat Events is not available to assign.
  </Step>

  <Step title="Determine Your API Gateway Region">
    Identify the **API Gateway region** for your Mimecast tenant. Use the default **global** region unless your tenant is served by a specific regional gateway.
  </Step>
</Steps>

<Note>
  Exact console navigation and labels vary across Mimecast versions. See the [Mimecast API 2.0 documentation](https://developer.services.mimecast.com/) for current steps to create an application and generate credentials.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the Mimecast Cloud Gateway integration with the following parameters:

### Required Parameters

| Parameter              | Description                                                    |
| ---------------------- | -------------------------------------------------------------- |
| **Client ID**          | Mimecast API 2.0 OAuth2 Client ID                              |
| **Client Secret**      | Mimecast API 2.0 OAuth2 Client Secret                          |
| **API Gateway region** | Mimecast API gateway region — optional, defaults to **global** |

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Email Security** in RAD Security
    2. Locate your Mimecast Cloud Gateway integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your Mimecast integration is now configured! RAD Security will ingest email threats from Mimecast on a scheduled basis.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Email Threats" icon="radar">
    Email threat detections — phishing, malware, impersonation — mapped to OCSF Detection Finding, stored as security findings, and correlated with runtime, cloud, and identity signals.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Threat Investigation" icon="magnifying-glass">
    Investigate Mimecast email threats with context from RAD runtime, cloud, and identity detections.
  </Card>

  <Card title="Correlated Detection" icon="diagram-project">
    Correlate Mimecast email threats with RAD runtime and identity signals to cut through the noise.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize Mimecast email threats by real-world impact.
  </Card>

  <Card title="Unified Findings" icon="layer-group">
    Review Mimecast email threats alongside the rest of your RAD security findings.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID or Client Secret
    * The API 2.0 application was disabled or its credentials were revoked in Mimecast
    * The API 2.0 application is **not entitled to the Threat Events API**. Mimecast reports a missing permission as `403 app_forbidden` ("Resource or method requested does not exist in any product assigned to the application"), which surfaces in RAD as **Authentication Failed** even though the credentials are valid.

    **Solution:**

    * Verify the Client ID and Client Secret are copied correctly (no extra spaces)
    * Confirm the API 2.0 application is still active under **API and Platform Integrations**
    * Confirm the application is assigned the product/permission for the **Threat Events** API (`/threats/v1/events`); if it is not provisioned on your account, contact Mimecast support to enable it. You do **not** need to regenerate the credentials — once the permission is added, reconnect with the same Client ID and Secret.
    * Regenerate the credentials in Mimecast and update them in RAD Security only if the keys themselves are wrong
  </Accordion>

  <Accordion title="Wrong Region" icon="globe">
    **Possible causes:**

    * The selected API Gateway region does not match your Mimecast tenant

    **Solution:**

    * Leave the region at **global** unless your tenant uses a specific regional gateway
    * Update the **API Gateway region** to match your tenant and reconnect
  </Accordion>

  <Accordion title="Empty Results" icon="inbox">
    **Possible causes:**

    * No email threats in scope for the configured time window or account

    **Solution:**

    * Confirm threat detections exist in the Mimecast Administration Console
    * If the connection fails rather than returning empty results, see **Authentication Failed** above — a missing Threat Events permission is reported as an authentication error, not as empty results
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use a Dedicated Application" icon="user-gear">
    Create a dedicated API 2.0 application for the RAD integration rather than reusing an existing one.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant only the read access required for email threats.
  </Card>

  <Card title="Rotate Credentials" icon="rotate">
    Rotate the Client Secret periodically according to your security policy.
  </Card>

  <Card title="Secure Secret Storage" icon="vault">
    Store the Client Secret in a secrets vault. Never commit it to version control.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="Mimecast API 2.0 Documentation" icon="book" href="https://developer.services.mimecast.com/">
    Official Mimecast API 2.0 documentation, including applications and credentials
  </Card>

  <Card title="Email Security Overview" icon="envelope-open-text" href="/rad-security/integrations/email-security/overview">
    Learn about RAD's email security integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Defender for Office 365 Setup" icon="microsoft" href="/rad-security/integrations/email-security/defender-for-office-setup">
    Connect Microsoft Defender for Office 365 for email threats and activity
  </Card>

  <Card title="Email Security Integrations" icon="envelope-open-text" href="/rad-security/integrations/email-security/overview">
    Explore other email security integration options
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot helps prioritize findings
  </Card>
</CardGroup>