Inbound email to your domain is routed through Mimecast MX records before delivery to Microsoft 365. Mimecast inspects every message through multiple processing engines sequentially:

Outbound mail from Microsoft 365 is relayed through Mimecast for DLP scanning, archiving, and branding injection. Mimecast adds DKIM signatures, enforces SPF alignment, and scans for data loss policy violations before releasing to the internet.

The orange LIVE bar at the top of the dashboard scrolls recent high-signal events from the Mimecast event stream. Events rotate every ~3.8 seconds and represent actual event types scoped to 13,241 endpoints — BEC blocks, malware detonations, SIEM batch pulls, URL rewrites, and policy sync confirmations.

The Recent High-Priority Alerts panel shows the five most recent events requiring analyst attention. Clicking any row opens a detailed modal with full event context, API response snippet, and action buttons:

• Investigate / View Hash: Opens event detail modal with sender data, TTP definition, API source, and code snippet.
• Block Domain: Fires a mock PUT /api/policy/blockedsenders call to add the sender domain to the blocked list. Updates the blocked sender count.
• Acknowledge: Marks the alert row as reviewed (visual dim), decrements the critical badge in the sidebar.
• Export to SIEM: Fires a mock batch export to Splunk/Sentinel.
• Ack All (panel header): Acknowledges all five current alerts simultaneously.

URL Protect rewrites every URL in inbound emails to route clicks through Mimecast's proxy. At click time, the destination is evaluated against live threat intelligence. If the URL is flagged, the user sees a Mimecast block page instead of the malicious site.

{
  "meta": {"status": 200, "totalCount": 241, "endpoints": 13241},
  "data": [{
    "id": "url001",
    "url": "hxxps://login-secure-bank[.]xyz/auth",
    "userEmailAddress": "j.smith@ktc-demo.com",
    "action": "Block",
    "reason": "Phishing",
    "ttpDefinition": "URL Protect - Default",
    "date": "2026-03-22T10:54:22+0000"
  }]
}

Attachment Protect intercepts all inbound attachments and submits them to Mimecast's sandbox for pre-emptive detonation before the message is delivered. Three operating modes are available:

Impersonation Protect detects attacks that use social engineering instead of malware — specifically Business Email Compromise (BEC), CEO fraud, typosquat domains, and internal spoofing. It uses a combination of AI-based analysis, custom monitored domain lists, and header inspection.

• Checkbox + Release Selected: Select multiple rows and batch-release. Messages animate out and the total counter decrements.
• Release (row): Delivers the held message to the recipient's inbox. Use for false positives confirmed by the user or analyst.
• Purge (row): Permanently deletes the message. Use for confirmed threats, spam, or policy violations. Cannot be undone.
• Purge All: Header button. Purges all visible held messages sequentially with staggered animation. Use during cleanup cycles.
• Release Selected: Header button. Batch-releases all checked rows.

Each API call returns a pointer to a compressed file containing up to ~25,000 events per batch at KTC-Demo-Org scale. The SIEM connector fetches, decompresses, parses, and indexes the events. At 13,241 endpoints, expect 20,000–30,000 events per 5-minute pull cycle during business hours.

The toggle switch on each policy row calls PUT /api/policy/{id}/enable or PUT /api/policy/{id}/disable and syncs the change across all 13,241 endpoints within ~60 seconds. In demo mode, toggling shows the state change and fires a toast confirmation. Note:

• Disabling SPF Strict in production will immediately allow spoofed mail to reach inboxes. Never disable without a maintenance window and change record.
• Disabling the M365 Relay Allow policy will block all outbound mail. Ensure this is your last resort during incident response.
• The Blocked Senders list is managed via API. The Operations Center allows additions via the Block Domain buttons in URL Protect, Attachment Protect, and Impersonation views.

The "Force AD Sync" button in the Directory view calls POST /api/directory/find-groups followed by a sync trigger. At 13,241 endpoints, expect a 3–5 minute sync cycle. The last sync timestamp updates on completion.

The SAFE Score is a 0–100 composite score per user based on phishing simulation behavior, training completion, and historical click rates. Lower scores = higher risk. The Operations Center displays the org-wide average (74 for KTC-Demo-Org) and surfaces the top 5 high-risk users out of 38.

The Operations Center displays active and completed campaigns with sent/clicked/reported rates. Click rates tell the real story — not just whether users clicked, but whether they reported. A 5.8% click rate with 38% report rate (IT Help Desk Spoof) is significantly better than 11.5% click / 26% report (CEO Fraud Sim).

In the High Risk Users watchlist, clicking "Assign Training" fires POST /api/awareness-training/assign-module for that user and sends an email notification. The user's SAFE score recalculates within 24–48 hours of course completion.

• All Release and Purge actions animate the quarantine row out and decrement the sidebar badge — no API call is made in demo mode.
• Block Domain buttons fire a toast notification and simulate adding to the blocked senders list. The blocked entry count is not persisted between sessions.
• The API Explorer returns mock responses. Selecting a template + clicking RUN always returns 200 OK with realistic demo data scoped to 13,241 endpoints.
• Live counters drift upward every 5 seconds to simulate real-world mail volume. Refresh All resets counters to new random baselines.
• The auth token TTL counts down from 28 minutes and fires a warning toast at 0. In production, this represents a real OAuth token expiry — implement auto-refresh.