Store and analyze data in a uniform manner across all data sources

By integrating Mimecast and Elastic Security, organizations gain search and correlation capabilities across data fabric to detect and respond to cyberattacks. Dashboards update in near-real time and get paired  with security analytics to speed up detection times across the attack surface. 

New data can be added with Elastic Security integrations, Mimecast, community-built plug-ins, and custom connectors. Elastic Security is strong enough to analyze and monitor years’ worth of historical data. This data helps gain visibility across the global environment to remediate threats at a larger scale. The user can automate the detection of malicious threats and prioritize which threats to mitigate first. 

The integration ingests Mimecast logs relating to email activity, audit events, and DLP detections which trigger alerts within the Elastic Security Platform. The integration with Mimecast allows incident-response and threat-hunting teams to drill into events of interest and pivot through underlying data faster than ever.

TTP URL Protection Logs

Mimecast + Elastic Integration Use Cases:

• Threat correlation: Identify initial attack deployment methodology, characteristics and subsequent access attempts without manual effort or multiple toolsets. 
• Advanced threat detection: Improve your organization’s security posture and detect threats by augmenting email perimeter defense with user and entity behavior analytics. 
• Lateral movement detection: Detect and follow attackers even as they switch IP addresses, devices, or credentials. 
• Alert prioritization: Increase efficiency and effectiveness by prioritizing the most pressing threats. 
• Threat intelligence: Understand how your organization has been targeted and what attacks have been blocked for better protection at the email perimeter, inside the network and beyond its perimeter. 
• Threat investigation: Analyze activity events before and after an attack across the entire attack chain to enhance analyst productivity and remediate vulnerabilities