Mimecast Gateway Configuration Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects configuration changes on the Mimecast gateway. Mail gateway policy decides what reaches the organisation; weakening it — disabling attachment protection, adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for everyone at once and persists until someone notices. Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161). Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector BQL (Bloo Query Language): stream=authentication where sourcename='MIMECAST' and action='CONFIGURATION_CHANGED' | groupby user, srcip, reason