Mimecast Quarantined Mail Released in Volume
Detects quarantined messages being released at volume. Release overrides the gateway's own verdict, so a burst of releases either reflects a false positive wave or an attacker with administrative access letting their own delivery through the control that stopped it. Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161). Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MIMECAST' and action='EMAIL_QUARANTINED' | duration 1h | groupby sender, recipient, direction
Sigma
