Skip to content

Commit 0b1abb0

Browse files
efd6efd6
committed
mimecast: add message release logs data stream
1 parent 31ad9a6 commit 0b1abb0

File tree

16 files changed

+1929
-2
lines changed

16 files changed

+1929
-2
lines changed

‎packages/mimecast/_dev/build/docs/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,17 @@ https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-stat
4848

4949
{{fields "dlp_logs"}}
5050

51+
### Message Release Logs
52+
53+
This is the `mimecast.message_release_logs` dataset. These logs contain information about
54+
messages that were either released to the recipient, with details about the user that
55+
processed the release. More information about [these logs](
56+
https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-message-release-logs/).
57+
58+
{{event "message_release_logs"}}
59+
60+
{{fields "message_release_logs"}}
61+
5162
### SIEM Logs
5263

5364
This is the `mimecast.siem_logs` dataset. These logs contain information about

‎packages/mimecast/_dev/deploy/docker/files/config.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,3 +230,139 @@ rules:
230230
- "application/json"
231231
body: |-
232232
{"meta":{"status":200,"pagination":{"pageSize":10,"totalCount":20,"next": "nextToken"}},"data":[{"clickLogs":[{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.com/alerts/feeds/00259755281018227146/14369994449842858162","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - dollar","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"N/A","date":"2021-11-10T08:55:53+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<11-0000000000004109b705d06b609c@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.co.za/alerts?source=alertsmail&hl=en&gl=US&msgid=MTgzMTU0Mzc2MTA3OTY3MzIxNw&s=AB2Xq4g-GUg7dJreWJN14pFdqYo0nYsyiVX2dK8&ffu=","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - china","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T08:50:37+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<12-00000000000079a99a05d06b4d20@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.com/url?rct=j&sa=t&url=https://texassports.com/news/2021/11/10/no-5-5-mens-basketball-tops-houston-baptist-in-season-opener-92-48.aspx&ct=ga&cd=CAEYACoUMTEzMjI3MjkwNzM0OTE1Nzg0NDMyHGMzNzg3MjBmODY3MWM2MGY6Y29tOmVuOlVTOkw&usg=AFQjCNG4_460IiZmbwJkDzkFkQC5-htSxw","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - news","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T08:28:18+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<13-0000000000005fa4e905d06afd8f@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.co.za/alerts/feedback?ffu=https://www.ft.com/content/4d61fac4-e3f3-401b-bca2-6e94ff47e2cc&source=alertsmail&hl=en&gl=US&msgid=MTM1OTYyMDAwNTE0MzU3NjA0NjI&s=AB2Xq4g-GUg7dJreWJN14pFdqYo0nYsyiVX2dK8","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - china","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T07:50:16+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<14-000000000000eb13ab05d06a76fc@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.com/alerts/feedback?ffu=https://www.fox7austin.com/news/search-for-suspect-involved-in-aggravated-robbery-at-family-dollar&source=alertsmail&hl=en&gl=US&msgid=ODM0MDY5Nzg2NzI3NDkxMjUwNg&s=AB2Xq4i7OaFz4ss3vFU-wNb0DTELEKxhyDdFl54","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - dollar","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T06:55:34+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<15-0000000000001ddf7205d069b36e@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.co.za/alerts?source=alertsmail&hl=en&gl=US&msgid=NDgxNzM4MzYwOTM2NzY1MDg2Ng","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - china","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T06:50:16+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<16-000000000000567c2105d069a0ce@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.com/alerts/share?hl=en&gl=US&ru=https://www.ctvnews.ca/world/judge-denies-trump-s-overnight-request-for-injunction-in-executive-privilege-case-1.5658613&ss=tw&rt=Judge+denies+Trump%27s+overnight+request+for+injunction+in+executive+privilege+case+%7C+CTV+News&cd=KhM2MTQ1MDcxODY2MDQ5NTY2MDk2Mhw1MzNlMDE2OWZhYWUyMDBkOmNvbTplbjpVUzpM&ssp=AMJHsmXlnSoHb_ZABC-riiVXrxFyWhlMpQ","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - Trump","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T05:11:56+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<17-000000000000e78cfa05d0683fab@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.com/alerts?s=AB2Xq4i7OaFz4ss3vFU-wNb0DTELEKxhyDdFl54&start=1636516479&end=1636520078&source=alertsmail&hl=en&gl=US&msgid=MTMyNTI1OTY4MzI3OTI0NDc4MTU#history","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - dollar","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T04:55:34+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<18-000000000000f2696405d0680583@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.gstati","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - dollar","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Unknown","sendingIp":"8.8.8.8","userAwarenessAction":"N/A","date":"2021-11-10T03:55:09+0000","actions":"Browser Isolation","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<19-00000000000065020205d0672f01@google.com>"},{"userEmailAddress":"johndoe@example.com","fromUserEmailAddress":"googlealerts-noreply@google.com","url":"https://www.google.co.za/alerts/share?hl=en&gl=US&ru=https://www.wsj.com/articles/u-s-tests-israels-iron-dome-in-guam-as-defense-against-chinese-cruise-missiles-11636455224&ss=tw&rt=U.S.+Tests+Israel%27s+Iron+Dome+in+Guam+as+Defense+Against+Chinese+Cruise+Missiles+-+WSJ&cd=KhQxNzg2NTc5NDQ3ODIzODUyNjI5NzIcZmQ4N2VjYzkxMGIxMWE4Yzpjby56YTplbjpVUw&ssp=AMJHsmW3CCK1S4TNPifSXszcyaNMwd6TDg","ttpDefinition":"Inbound URL 'Aggressive'","subject":"Google Alert - china","action":"allow","adminOverride":"N/A","userOverride":"None","scanResult":"clean","category":"Search Engines & Portals","sendingIp":"8.8.8.8","userAwarenessAction":"Continue","date":"2021-11-10T03:49:53+0000","actions":"Allow","route":"inbound","creationMethod":"User Click","emailPartsDescription":["Body"],"messageId":"<20-000000000000a02a0a05d0671c06@google.com>"}]}],"fail":[]}
233+
- path: /api/gateway/get-held-release-logs
234+
methods: ["POST"]
235+
request_body: /"meta":\{"pagination":\{"pageSize":100\}\}/
236+
request_headers:
237+
authorization: ["MC .*"]
238+
responses:
239+
- status_code: 200
240+
headers:
241+
Content-Type:
242+
- "application/json"
243+
body: |-
244+
{{ minify_json `
245+
{
246+
"fail": [],
247+
"meta": {
248+
"status": 200,
249+
"pagination": {
250+
"pageSize": 25,
251+
"next": "String",
252+
"previous": "String"
253+
}
254+
},
255+
"data": [
256+
{
257+
"heldReleaseLogs": [
258+
{
259+
"spamProcessingDetail": {
260+
"greyEmail": true,
261+
"permittedSender": {
262+
"allow": true,
263+
"info": "allow"
264+
},
265+
"managedSender": {
266+
"allow": true,
267+
"info": "allow"
268+
},
269+
"dkim": {
270+
"allow": true,
271+
"info": "allow"
272+
},
273+
"spf": {
274+
"allow": true,
275+
"info": "allow"
276+
},
277+
"rbl": {
278+
"allow": true,
279+
"info": "allow"
280+
},
281+
"dmarc": {
282+
"allow": true,
283+
"info": "allow"
284+
},
285+
"spamVerdict": {
286+
"decision": "spam",
287+
"description": "",
288+
"risk": "low",
289+
"categories": [
290+
{
291+
"name": "spam",
292+
"risk": "low",
293+
"subcategories": [
294+
{
295+
"name": "phishing",
296+
"risk": "low",
297+
"augmentations": [
298+
{
299+
"name": "body",
300+
"risk": "negligible"
301+
}
302+
]
303+
}
304+
]
305+
}
306+
]
307+
}
308+
},
309+
"attachments": true,
310+
"messageInfo": "Expired in queue - rejected by housekeeping",
311+
"subject": "Exclusive Offer - You don't want to miss this!",
312+
"detectionLevel": "moderate",
313+
"heldGroup": "IT Staff Global",
314+
"operator": "admin@domain.tld",
315+
"fromEnv": {
316+
"emailAddress": "user@domain.tld",
317+
"displayableName": "FirstName LastName"
318+
},
319+
"rejectReason": "Message contains undesirable content",
320+
"route": "inbound",
321+
"size": 5043,
322+
"heldReason": "High-Confidence Impersonation Protection",
323+
"spamScore": 12,
324+
"id": "eNpVj21LhEAUhf_LfN2VnRl1RpclCN...",
325+
"to": [
326+
{
327+
"emailAddress": "user@domain.tld",
328+
"displayableName": "FirstName LastName"
329+
}
330+
],
331+
"released": "2015-11-25T14:49:18+00:00",
332+
"fromHdr": {
333+
"emailAddress": "user@domain.tld",
334+
"displayableName": "FirstName LastName"
335+
},
336+
"status": "released",
337+
"policy": "Moderate Spam Detection"
338+
}
339+
]
340+
}
341+
]
342+
}
343+
`}}
344+
- path: /api/gateway/get-held-release-logs
345+
methods: ["POST"]
346+
request_body: /"meta":\{"pagination":\{"pageSize":100,"pageToken":"String"\}\}/
347+
request_headers:
348+
authorization: ["MC .*"]
349+
responses:
350+
- status_code: 200
351+
headers:
352+
Content-Type:
353+
- "application/json"
354+
body: |-
355+
{{ minify_json `
356+
{
357+
"fail": [],
358+
"meta": {
359+
"status": 200,
360+
"pagination": {
361+
"pageSize": 25,
362+
"next": "String",
363+
"previous": "String"
364+
}
365+
},
366+
"data": []
367+
}
368+
`}}

‎packages/mimecast/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.27.0"
3+
changes:
4+
- description: Add support for message release logs.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/10732
27
- version: "1.26.1"
38
changes:
49
- description: Fix handling of email addresses with comma in quoted name.

‎packages/mimecast/data_stream/message_release_logs/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fields:
2+
tags:
3+
- preserve_original_event

0 commit comments

Comments
 (0)