HOME ⚠ DEMO VERSION — DATA IS NOT LIVE
Mimecast
EMAIL SECURITY OPERATIONS CENTER
PROTECTED: 13,241 ENDPOINTS
Tenant: KTC-Demo-Org
API Connected
UTC --:--:--
Live · API 2.0 · us-api.services.mimecast.com
Security Overview
LIVE
Initializing Mimecast event stream…
--:--:--
Threats Blocked (24h)
0
API: /threats/events
Quarantined Today
0
API: /message/get-hold
URL Clicks Blocked
0
API: /ttp/url/get-logs
Emails Processed
0
API: /siem/v1/batch/events
Spam Rejected
0
API: /stats/gateway
🛡Threat Breakdown — Last 24h
View All →
Ransomware / Malware
Attachment Protect — sandbox detonation
0
--:--
Phishing / Spear-Phishing
URL Protect + Impersonation detect
0
--:--
Business Email Compromise
Impersonation Protect — CEO/CFO fraud
0
--:--
Malicious URL (clicked)
TTP URL Protect — on-click block
0
--:--
Spam / Bulk
Gateway — anti-spam engine
0
--:--
🚨Recent High-Priority Alerts
Ack All
All Alerts →
BEC Attempt — CEO Impersonation
From: [email protected] ← spoofed · To: [email protected]
11:42
Investigate
Malicious Attachment — Ransomware
invoice_Q1_2026.xlsm · SHA256: 5f4dcc3b… · Sandbox: BLOCKED
11:18
View Hash
Malicious URL — User Click Blocked
hxxps://login-secure-bank[.]xyz/auth · User: [email protected]
10:54
URL Detail
Spear-Phishing — IT Impersonation
From: [email protected] · Typo-squatted domain
10:31
Quarantine
Bulk Spam Campaign — 1,812 copies
Subject: "You've won a prize!" · 1,812 recipients · Gateway blocked
09:47
Details
📊Threat Volume — Hourly (24h)
API Source
00:0006:0012:0018:00Now
📨Top Threat Origin Domains
API Source
acme-corp.co
441
microsofft.com
312
login-secure-bank.xyz
236
paypa1-verify.net
176
shared-docs-view.ru
110
API: /threats/events · 13,241 endpoints
Threat Events
🛡All Threat Events — Last 24h
All
CRIT
HIGH
MED
Export CSV
SeverityTypeSenderRecipientSubjectActionTime
CRITBEC / Impersonation[email protected][email protected]Urgent wire transfer neededBLOCKED11:42
CRITRansomware Attachment[email protected][email protected]Invoice Q1 2026 - Action RequiredSANDBOX11:18
CRITMalware Dropper[email protected][email protected]Shared document: Q1 Report.docmBLOCKED10:55
HIGHURL — Malicious Click[email protected][email protected]Your account needs verificationCLICK BLOCKED10:54
HIGHSpear-Phishing[email protected][email protected]Password expiry notice - act nowQUARANTINED10:31
MEDImpersonation[email protected][email protected]Quick question - confidentialTAGGED09:58
MEDURL — Phishing Page[email protected][email protected]Verify your PayPal accountBLOCKED09:22
LOWSpam — Bulk[email protected]1,812 recipientsYou've been selected!BLOCKED09:47
LOWSpam — Bulk[email protected]892 recipientsFlash Sale - Today OnlyBLOCKED08:14
API: /ttp/url/get-logs · 13,241 endpoints
URL Protect — TTP
URLs Blocked Today
241
Malicious / phishing
▲ +67 vs yesterday
User Clicks Blocked
67
On-click real-time block
Safe URLs Scanned
148,220
Rewritten & scanned
99.8% safe
Blocked URL Events
API Source
URL (sanitized)UserActionCategoryTimeActions
hxxps://login-secure-bank[.]xyz/authj.smithBLOCKEDPhishing10:54
hxxps://paypa1-verify[.]net/loginm.jonesBLOCKEDCredential Harvest09:22
hxxps://docusign-sign[.]info/doc/viewa.chenWARNSuspicious08:47
hxxps://shared-docs-view[.]ru/file/Q1ops-userBLOCKEDMalware DL08:12
hxxps://microsofft[.]com/signinr.kimBLOCKEDTyposquat07:30
API: /ttp/attachment/get-logs · 13,241 endpoints
Attachment Protect — TTP
Malicious Blocked
18
Sandbox detonation
Sandboxed Today
218
Pre-emptive analysis
Safe Delivered
62,814
Converted & delivered
Sandbox Detections — File Analysis
API Source
FilenameTypeSHA256VerdictSenderTimeActions
invoice_Q1_2026.xlsmXLSM5f4dcc3b5aa7…MALICIOUS[email protected]11:18
Q1_Report.docmDOCMaab3238922bc…MALICIOUS[email protected]10:55
remittance_advice.exe.pdfEXEc4ca4238a0b9…MALICIOUS[email protected]09:14
contract_draft.docxDOCXeccbc87e4b5c…CLEAN[email protected]08:52—
salary_review.pdfPDFc81e728d9d4c…CLEAN[email protected]08:20—
API: /ttp/impersonation/get-logs · 13,241 endpoints
Impersonation Protect — TTP
BEC Attempts
43
CEO/CFO fraud detected
Typosquat Domains
71
Similar domain abuse
Internal Spoofed
18
From-header spoofing
Impersonation Events
API Source
Impersonation TypeSpoofed IdentitySender DomainRecipientActionTimeActions
CEO FraudM. Johnson, CEOacme-corp.co[email protected]BLOCKED11:42
CFO FraudS. Williams, CFOktc-demo.co[email protected]BLOCKED10:15
IT ImpersonationIT Help Deskktcdemo-helpdesk.net[email protected]QUARANTINED10:31
TyposquatMicrosoftmicrosofft.com[email protected]BLOCKED07:30
Brand AbuseDocuSigndocusign-sign.info[email protected]TAGGED08:47
API: /stats/gateway · hourly & daily · 13,241 endpoints
Gateway Statistics
Inbound Processed
94,822
Last 24h · 13,241 endpoints
Outbound Processed
22,418
Last 24h
Malware Blocked
680
Anti-virus engine
Spam Rejected
18,441
99.2% catch rate
Email Volume by Hour
08:00 – 09:00
11,408
09:00 – 10:00
18,224
10:00 – 11:00
22,284
11:00 – 12:00
24,012
12:00 – 13:00
13,148
Traffic Disposition
76%
Delivered Clean
76%
Blocked / Rejected
18%
Quarantined
4%
Held / Review
2%
API: /message/get-hold-message-list · 13,241 endpoints
Quarantine
Showing top 10 of 183 held messages across 13,241 endpoints · API: /message/get-hold-message-list · pageSize=10 · totalCount=183
Held Messages — Pending Review
API Source
Release Selected
ReasonFromToSubjectHeld SinceActions
SUSPICIOUS[email protected]a.chenPassword expiry notice10:31
MALWARE[email protected]accountingInvoice Q1 202611:18
SPAM[email protected]892 usersFlash Sale - Today Only08:14
POLICY[email protected][email protected]Large file share link07:44
DLP[email protected][email protected]Patient data spreadsheet07:11
BEC[email protected][email protected]Quick question re: payroll09:58
SUSPICIOUS[email protected][email protected]Sign document now08:47
API: /siem/v1/batch/events · 13,241 endpoints
SIEM Log Batch
Events This Batch
24,821
Last pull: 5 min ago
Log Types
7
receipt, delivery, ttp, av…
SIEM Destinations
2
Splunk + Sentinel
Sample SIEM Event Output
View Full API Call
{"datetime": "2026-03-22T11:42:18+0000", "acc": "KTC-Demo-Org", "endpoints": 13241, "Sender": "[email protected]", "Recipient": "[email protected]", "Dir": "Inbound", "Act": "Blk", "RejType": "Impersonation", "RejCode": "TT0004", "Definition": "BEC High Risk", "Subtype": "BEC"} {"datetime": "2026-03-22T11:18:05+0000", "acc": "KTC-Demo-Org", "endpoints": 13241, "Sender": "[email protected]", "Recipient": "[email protected]", "Dir": "Inbound", "Act": "Blk", "RejType": "MaliciousAttachment", "sandboxResult": "Malicious", "fileHash": "5f4dcc3b5aa765d6...", "Definition": "Attachment Protect - Pre-emptive"}
API: /policy/blockedsenders · /policy/antispoofing · 13,241 endpoints
Security Policies
Active Gateway Policies
API Source
Block — Known Malicious Senders
All inbound · 4,218 entries
BLOCK
Quarantine — Suspicious Attachments
Inbound · .xlsm .docm .exe .vbs .ps1
QUARANTINE
Tag — External Sender Warning
All inbound from external domains
TAG
Anti-Spoofing SPF Strict
All inbound · SPF fail = reject
REJECT
DLP — PII Outbound Scan
Outbound · SSN / CC / PHI patterns
HOLD
Allow — Microsoft 365 Relay
Outbound · IP whitelist · 8 IPs
ALLOW
API: /directory/find-groups · /directory/get-group-members · 13,241 endpoints
Directory Groups
Security Groups · 13,241 Total Endpoints
API Source
Group NameMembersEndpointsPolicy AppliedSync SourceLast SyncActions
Executive Leadership5252BEC High Risk PolicyAzure ADToday 06:00
Finance Department128128Wire Fraud PolicyAzure ADToday 06:00
IT Administrators34204Bypass External TagAzure ADToday 06:00
All Staff8,2418,241Standard TTP PolicyLDAPToday 06:00
Infrastructure Servers—4,616Server TTP PolicyAPI ManagedToday 06:00
Blocked Senders List4,218 domainsAllBlock AllAPI Managed11:42 today
API: /awareness-training/get-campaigns · /awareness-training/get-safe-score-summary · 8,241 users
Awareness Training
Avg SAFE Score
74
org-wide · /100 · 8,241 users
▲ +4 this month
Active Campaigns
3
Phishing simulation
Training Pending
842
Users overdue
High Risk Users
38
SAFE score < 40
Active Phishing Campaigns
API Source
CampaignSentClickedReportedStatusActions
Q1 2026 — CEO Fraud Sim8,241948 (11.5%)2,194ACTIVE
IT Help Desk Spoof8,241478 (5.8%)3,181ACTIVE
PayPal Invoice Phish8,241214 (2.6%)5,097COMPLETE
High Risk Users — Watchlist (Top 5 of 38)
UserSAFE ScoreClicksAction
[email protected]226
[email protected]285
[email protected]314
[email protected]363
[email protected]383
Interactive · Mimecast API 2.0
API Explorer
✅Demo mode active — returns realistic Mimecast API 2.0 responses scoped to 13,241 endpoints. Connect Client ID + Secret for live production data.
Select a template below and click RUN to get a demo Mimecast API response.
Ready Mimecast API 2.0 · Demo Mode · 13,241 endpoints
Quick Templates
GET/api/ttp/url/get-logs
GET/api/ttp/impersonation/get-logs
GET/api/ttp/attachment/get-logs
POST/api/siem/v1/batch/events
POST/api/message/get-hold-message-list
POST/api/awareness-training/get-safe-score-summary
GET/api/stats/gateway
POST/api/directory/find-groups
Ops · 13,241 endpoints
API Status & Rate Limits
API Gateway
● Online
us-api.services.mimecast.com
Auth Token
Valid
Expires in 28 min
Rate Limit Used
423/1000
Per minute window
API Calls Today
0
All endpoints
Endpoint Rate Limits
EndpointQuotaUsedResetStatus
/api/ttp/url/get-logs100/min57:42sMODERATE
/api/ttp/impersonation/get-logs100/min43:42sOK
/api/siem/v1/batch/events10/min3:42sOK
/api/message/get-hold-message-list50/min38:42sMODERATE
/api/awareness-training/*20/min4:42sOK
/api/stats/gateway60/min12:42sOK
✕
✅