LSO : Flat File - Mimecast Email (Mapping Doc)

This document explains the changes required to apply new Message Processing Engine (MPE) rules developed during the Log Source Optimization (LSO) project for the Flat File - Mimecast Email log source type.

Vendor Documentation

https://integrations.mimecast.com/documentation/tutorials/understanding-siem-logs/

Prerequisites

Download and apply the Knowledge Base. For more information, see KB Synchronization Settings for LSO.
Enable the new MPE rules in the LogRhythm System Monitor.
- Select log source type Flat File - Mimecast Email.
- Enable log processing policy LogRhythm Default v2.0.

For details on how to enable LogRhythm Default v2.0, see Apply LogRhythm Default v2.0 on a Log Source.

Supported Log Messages

The following table lists the log message types supported in the current MPE rules. Each page contains detailed information on parsing changes and new log processing settings.

Log Message Type	Event Type
Email Attachment	General Email Attachment Message
Email Details	General Information
Email Log Details	General Information
Email Spam Information	General Email Handling Message
Email Statistic Information	General Email Attachment Message
General Blocked Event	Blocked Message
General Email Attachment Message	General Email Attachment Message
General Email Information	General Email Delivery Information
General Email Information 2	General Email Delivery Information
General Email Information 3	General Email Delivery Information
General Email Information 4	General Email Delivery Information

Log Processing Policy Updates

This section details log processing policy updates made to AIE Rules, system reports, system investigations, system report templates, and system tails as part of LSO.

Updates to AIE Rules

No changes

Updates to System Reports

No changes

Updates to System Investigations

No changes

Updates to System Report Templates

No changes

Updates to System Tails

No changes