API 2.0 Overview API 1.0 to 2.0 Migration Guide What's New
Action Usecase Alerting Usecase Analysis and Response API's Building Search Queries Configuration Backup Restore and Export APIs Enrichment Usecase Groups Usecase Mimecast API In Power BI Secure Email Gateway SIEM Tutorial CG SIEM Tutorial CI SIEM Batch CG Guidelines SIEM Batch CI Guidelines
API 2.0 Reference API 1.0 Reference
Technology Partners
Become a Partner

Making Use of Groups in Mimecast

While seeming simple, groups provide the ability to heavily alter how Mimecast functions, and how a user’s interaction with Mimecast can be changed.

The examples below are not necessarily specific to integrations, and many require manual initial set up within Mimecast. These are meant to show the potential benefits that external intelligence can help Mimecast better protect customers.

For information on group management API endpoints, you can visit the Directory Endpoints documentation.

Assumptions

This document uses terms and phrases that may be specific to Mimecast. To learn more about Mimecast terminology and capabilities (policies, groups, etc.), please refer to Mimecaster Central.

Mail Flow

Mail flow actions are organized in proactive and reactive groups:

  • Proactive groups are commonly professional service organizations and financial institutions, where protecting intellectual property, finances and reputation are key factors.
  • Reactive groups are commonly healthcare, where failure to communicate timely could affect the well-being of a person.

Outbound and internal

Proactive actions:

Proactive Action
 Example
Prevention Type
 More Information
Block a user from sending to the customer's top-10 client or vendor group   High-risk user is not able to represent the company Supply-chain attack, Insider threat Using a group that contains a high-risk user and another group that contains the "Top-10" list, a Blocked Sender Policy can be created to prevent the first group from communicating with the second group
Block a user from sending any email outbound User is not able to use email as a point of data-exfiltration to their personal account Insider threat, Potential leaver A Blocked Sender Policy can be applied using the group
More strict scanning is applied to URLs (e.g., questionable, but not outright malicious) in all outbound email from a user, to identify attempted supply-chain attack or insider threat High-risk user is not able to send a link to a domain similar to their own or a client's domain Supply-chain attack, Insider threat
 An alternate URL Protection policy can be applied
Prevent a user from being allowed to send specific attachment types, regardless of their scan results
 high-risk user is not allowed to send out zipped or password-protected zip files
 Supply-chain attack, Insider threat, Potential leaver
 An alternate Attachment Management policy can be applied
Hold all outbound emails for a user
 High-risk user is not able to represent the company at all, and messages must be reviewed before going out
 Supply-chain attack, Insider threat
 A Content Examination policy can be applied, using the hold action
Flag or hold a user's outbound messages which contain some less confident phrases indicating supply-chain attack or insider threat
 High-risk user is not able to send emails with phrases or words of urgency sent outbound, and generate an alert if internal
 Supply-chain attack, Insider threat
 A Content Examination policy can be applied, using the Hold or Stationery actions
A user’s ability to send outbound emails can be throttled altogether, or based on specific patterns in the message
 High-risk user is not allowed to send emails at a pace that could resemble a spray-and-pray attack
 Supply-chain attack, Insider threat, Potential leaver
 A Recipient Limitation policy can be applied

 Reactive actions:

Action
Example
 More Information
Outbound messages can be sent as Secure Messages, where we retain chain of custody and can revoke access to those message after-the-fact
 High-Risk user's outbound emails can effectively be 'recalled' regardless of the recipient's mail platform
 A Secure Messaging policy can be applied
All User's outbound and internal messages are copied to a security team for manual review
 High-risk user's messages are BCC'd to a mailbox for review
 A Group Carbon Copy policy can be applied
User's outbound and internal messages matching specific words or phrases alert a security team for review
 High-risk user's messages containing words or phrases of urgency are BCC'd to security mailbox for review
 A Content Examination policy can be applied, with the Group Carbon Copy action
Alerts are generated for any lower-confidence scan on outbound emails
 High-risk user sending PDF, Office or zip files outbound alert the security team
 An alternate Attachment Management policy can be applied
Outbound emails have a banner applied indicating that the sender's communication should be confirmed via a known alternative communication method
 High-risk user's outbound emails have a "Does this communication seem out of the ordinary? Please call our main office and ask to be transferred to this user for verification." banner applied
 A Stationery policy can be applied

Inbound

Proactive actions:

Action Example
 More Information
Low-confidence phishing emails are administratively held for high-risk users, where they would have been otherwise held at a user level or had a banner apply
 High-risk user cannot receive emails with only one or two suspicious indicators
 An Impersonation Protection policy can be applied, using the Hold action at an administrative level
Remove some of all of attachments from emails, regardless of their scan result
 High-risk user is not allowed to receive password-protected zip files that cannot be brute-forced for scanning by Mimecast An alternate Attachment Management policy can be applied
Apply more strict URL scanning
 High-risk user is not allowed to click on links in a message that are similar to the top-10 vendor/client domains An alternate URL Protection policy can be applied

Reactive actions:

Action Example
 More Information
Smart tags can be applied where recipient is a high-risk user and the message contains low-confidence indicators
 Messages to a high-risk user with words or phrases of urgency are flagged for review out-of-band
 A Smart Tag Assignment policy can be applied
Low-confidence phishing emails to high-risk users generate an alert  Security team is alerted with a high-risk user receives an email that matched only a single phrase
 An Impersonation Protection policy can be applied, with the notification option configured

Interaction

Access to Mimecast

Users added to a group can have a reduced experience, removing access to features like:

Feature Information
 More Information
Searching the archive
 We retain up to 99 years of customers' emails outside of M365 and Google Workspace, which may contain company confidential or proprietary information
 An alternate Application Setting can be applied, with search options restricted to disabled
Sending or receiving emails through Mimecast (as an alternative to M365 or Google Workspace)
 Mimecast have a continuity product, where a customer can continue to send/receive through Mimecast in the event of an issue accessing M365 or Google Workspace
 An alternate Application Setting can be applied, with the option to send emails disabled

Access restrictions can be applied, such as:

Restriction Example More Information
Restrict access based on IP ranges
 Access to Mimecast's archive, continuity, and hold queues can be restricted to physical office locations for potentially compromised users
 An alternate Application Setting can be applied, which uses an alternate Authentication Profile
Restrict access to web, mobile apps, Outlook plugin altogether or individually
 High-risk users are unable to use Mimecast's mobile app to send/receive email
 An alternate Application Setting can be applied, which has specific or all methods of accessing Mimecast disabled
Remove the ability to manage held queue items
 High-risk user cannot be trusted to release messages held by Mimecast as spam or graymail (also known as bulk mail)
 An alternate Application Setting can be applied, which has queue management options disabled
Remove access to Large File Send (LFS), which can be used to send large files or directories outbound
 High-risk user cannot try to use LFS as a point of data-exfiltration
 An alternate Application Setting can be applied, which has LFS options disabled

Awareness Training

Users classified as high risk can be scheduled for additional targeted training, either generally or based on specific risk types, such as:

  • Phishing
  • BYOD
  • Social Media
  • Passwords
  • Inadvertent Disclosure
  • Insider Threat
  • Shadow IT
  • Storage Devices
  • Reporting Threats
  • Tailgating

In each case, a Scheduled Campaign will be applied to a group of users. The group membership can be modified via API.

 

Back to Top