/threat-intelligence

name: "Mimecast Threat Intelligence"
description: >
  Mimecast threat data: Targeted Threat Protection logs for URL clicks,
  attachment analysis, and impersonation attempts; threat remediation
  incidents; and audit events.
when_to_use: >-
  When investigating Mimecast threat activity, reviewing TTP detections, or auditing admin
  actions. Use when: mimecast threat, TTP, mimecast URL protection, mimecast attachment
  protection, mimecast impersonation, mimecast incident, mimecast threat remediation, mimecast
  targeted threat protection, mimecast phishing, or mimecast malware.

Mimecast Threat Intelligence

Overview

Mimecast's Targeted Threat Protection (TTP) is an advanced security layer that inspects URLs and attachments in real time and detects impersonation attempts. When TTP events occur — a user clicking a suspicious URL, a malicious attachment being sandboxed, or an impersonation attempt being identified — Mimecast logs these as TTP events that feed into threat remediation incidents. This skill covers reading TTP logs, reviewing threat remediation incidents, and using audit events to investigate security events.

Anti-triggers

• **Tracing, holding, or releasing the message that carried the threat**

— TTP logs are read-only evidence and carry no disposition controls; use `Mimecast Message Tracking`.

• **Detection based on how a sender normally behaves** — TTP is

reputation, sandbox, and lookalike-domain driven. Behavioural BEC modelling of established relationships is a different product; use `Abnormal Security Threats`.

• **Mail that is delayed rather than attacked** — use

`Mimecast Queue Management`.

Key Concepts

Targeted Threat Protection (TTP)

TTP has three components:

1. **URL Protection** — Rewrites URLs in emails and checks them at click time against reputation databases. Tracks every URL click attempt, whether blocked or permitted. 2. **Attachment Protection** — Sandboxes email attachments before delivery. Detects malware, zero-day exploits, and suspicious macros. 3. **Impersonation Protection** — Detects emails that spoof trusted senders — executives, trusted domains, or known contacts.

Threat Remediation Incidents

When TTP identifies a confirmed threat (e.g. a URL classified as malicious after delivery, or a sandboxed attachment containing malware), Mimecast can create a threat remediation incident — a structured record of the threat and recommended remediation actions, such as removing emails from user mailboxes.

Audit Events

The Mimecast audit log records all administrative actions and significant security events — policy changes, user login events, held message releases, and API operations. Useful for compliance investigations and detecting unauthorized admin activity.

API Patterns

Get TTP Logs

mimecast_get_ttp_logs

Retrieves TTP event logs across URL protection, attachment protection, and impersonation protection.

Parameters:

• `type` — Log type: `url`, `attachment`, or `impersonation`
• `start` — Start datetime (ISO 8601)
• `end` — End datetime (ISO 8601)
• `pageToken` — Pagination cursor

**Example — URL click logs:**

{
  "type": "url",
  "start": "2026-03-01T00:00:00Z",
  "end": "2026-03-02T23:59:59Z"
}

**Example URL TTP response:**

{
  "meta": {
    "status": 200,
    "pagination": {
      "pageSize": 25,
      "totalCount": 18,
      "next": null
    }
  },
  "data": [
    {
      "date": "2026-03-01T14:35:22Z",
      "url": "https://malicious-site.com/payload",
      "action": "block",
      "userEmail": "user@client.com",
      "from": "phishing@external-domain.com",
      "subject": "Your account needs attention",
      "messageId": "<abc123@external-domain.com>",
      "scanResult": "malicious",
      "category": "phishing"
    },
    {
      "date": "2026-03-01T09:12:05Z",
      "url": "https://legitimate-site.com/page",
      "action": "allow",
      "userEmail": "another@client.com",
      "from": "newsletter@legitimate-site.com",
      "subject": "Monthly Update",
      "messageId": "<def456@legitimate-site.com>",
      "scanResult": "clean",
      "category": null
    }
  ]
}

Key fields:

• `action` — `block` (URL blocked) or `allow` (URL permitted)
• `scanResult` — `malicious`, `suspicious`, or `clean`
• `category` — Threat category (phishing, malware, spam, etc.)

**Example — Attachment TTP response:**

{
  "meta": { "status": 200 },
  "data": [
    {
      "date": "2026-03-01T11:20:00Z",
      "filename": "invoice_march.xlsm",
      "result": "malicious",
      "definition": "Macro dropper — Emotet variant",
      "from": "billing@fake-vendor.net",
      "to": "accountspayable@client.com",
      "messageId": "<ghi789@fake-vendor.net>",
      "action": "block"
    }
  ]
}

**Example — Impersonation TTP response:**

{
  "meta": { "status": 200 },
  "data": [
    {
      "date": "2026-03-01T16:44:00Z",
      "from": "ceo@c1ient.com",
      "to": "cfo@client.com",
      "subject": "Urgent Wire Transfer",
      "action": "hold",
      "definition": "Domain lookalike — executive impersonation",
      "similarDomain": "client.com"
    }
  ]
}

Get Threat Remediation Incidents

mimecast_get_threat_incidents

Returns threat remediation incidents — confirmed threats requiring mailbox remediation.

Parameters:

• `start` — Start datetime (ISO 8601)
• `end` — End datetime (ISO 8601)
• `pageToken` — Pagination cursor

**Example response:**

{
  "meta": { "status": 200 },
  "data": [
    {
      "id": "TRI-20260301-001",
      "created": "2026-03-01T15:00:00Z",
      "type": "url",
      "status": "open",
      "severity": "high",
      "reason": "URL reclassified as malicious post-delivery",
      "url": "https://malicious-site.com/payload",
      "affectedUsers": [
        "user@client.com",
        "manager@client.com"
      ],
      "affectedMessages": 4,
      "remediationAction": "remove_from_mailbox",
      "remediat