Mimecast Inbound Threat Detected From Repeat Sender

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects threats identified by Mimecast where the same sender appears repeatedly. A single blocked message is routine; the same origin returning again and again is a campaign specifically targeting this organisation, and the repetition is the signal worth acting on rather than the individual block. Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161). Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector BQL (Bloo Query Language): stream=threat where sourcename='MIMECAST' and action='THREAT_DETECTED' | duration 24h | groupby sender, srcip | select sender, srcip, distinct_count(recipient) | having distinct_count_col1 > 5