Email Security

Email security integrations cover the gateways and mail-protection services that inspect inbound and outbound mail for phishing, malware and impersonation. Their logs answer the questions that start most incidents: who was sent what, who clicked, what was quarantined, and what was released afterwards. Message and click telemetry correlates directly with identity and endpoint data — a delivered-then-clicked URL followed by an unusual sign-in is a far stronger signal than either event alone — which is why these feeds are usually onboarded early.

In this section

• Avanan Email Protection — SIEM export configured in the Avanan portal and delivered to a HEC endpoint.
• Mimecast Cloud Gateway — mail-gateway message, URL-protect and attachment-protect logs over Mimecast API 2.0. The current path for new tenants.
• Mimecast (Legacy API 1.0) — the older five-key credential, for tenants still running on it, and how to migrate.
• Proofpoint TAP — Targeted Attack Protection click and message events from the TAP SIEM API. The enterprise product.
• Proofpoint Essentials — the same four threat streams from the small-business service, over a regional endpoint and an Integration Key.

Related

• Integrations catalog — all integration categories.
• Integration Matrix — which ingress method each product supports.
• HEC (Splunk-compatible) — the push transport several of these products use.
• Detections — rules that consume mail telemetry.