Transform Isolated Alerts Into Threat Context
Coordinated, Automated and Efficient Threat Detection and Incident Response
Mimecast and Blumira provide an integrated solution to improve detection, stop threats, augment security insights and centralize response across security functions. Email attack investigations usually require pivoting from one suspicious indicator to another to gather critical evidence, grabbing and archiving evidence and finalizing a resolution running these commands traps analysts in a screen-switching cycle.
Blumira’s cloud SIEM platform ingests rich Mimecast information to deliver an automated threat detection and response solution. The Mimecast Actions (logs, email activity, attachments) are available for analyst investigation – from a single interface. With the Mimecast integration with Blumira via Cloud Connectors, Blumira makes it easy to detect threats earlier and coordinate responses across all of the security functions.
Overview and Data Sources
Ingest email security telemetry from Mimecast directly into Blumira through real-time streaming and batch data feeds. SOC analysts gain immediate visibility into email threats, BEC attacks, malware detection events, and user behavior patterns within their existing SIEM workflows. The integration provides normalized threat indicators, executive impersonation alerts, and financial fraud detection data to accelerate threat correlation.
- Audit Logs
- Message Release Logs
- Rejection Logs
- Attachment Protect Logs
- Impersonation Protect Logs
- URL Protect Logs
Mimecast and Blumira Use Cases:
Mimecast data ingested adds additional data and context within Blumira to aid:
Threat Correlation
Identify initial attack deployment methodology, characteristics and subsequent access attempts without the need for manual effort or multiple toolsets.
Threat Intelligence
Threat Investigation
Contextual Email Threat Investigation
Alert Prioritization
Improve Response Times