Email Security

Email security integrations cover the gateways and mail-protection services that inspect inbound and outbound mail for phishing, malware and impersonation. Their logs answer the questions that start most incidents: who was sent what, who clicked, what was quarantined, and what was released afterwards. Message and click telemetry correlates directly with identity and endpoint data (a delivered-then-clicked URL followed by an unusual sign-in is a far stronger signal than either event alone), which is why these feeds are usually onboarded early.

In this section

• Avanan Email Protection: SIEM export configured in the Avanan portal and delivered to a HEC endpoint.
• Mimecast Cloud Gateway: mail-gateway message, URL-protect and attachment-protect logs over Mimecast API 2.0. The current path for new tenants.
• Mimecast (Legacy API 1.0): the older five-key credential, for tenants still running on it, and how to migrate.
• Proofpoint Essentials: the same four threat streams as TAP, from the small-business service, over a regional endpoint and an Integration Key.
• Proofpoint TAP: Targeted Attack Protection click and message events from the TAP SIEM API. The enterprise product.

Related

• Integrations catalog: all integration categories.
• Integration Matrix: which ingress method each product supports.
• HEC (Splunk-compatible): the push transport several of these products use.
• Detections: rules that consume mail telemetry.