Mimecast

What is Mimecast?

Mimecast is a cloud-based email security platform that sits in front of an organization's email infrastructure, inspecting every inbound and outbound message for threats before delivery. Its detection capabilities cover phishing, spear phishing, business email compromise, ransomware attachments, malicious URLs, and impersonation attacks that spoof trusted domains or individuals. Beyond threat detection, Mimecast provides email archiving for compliance and e-discovery purposes, email continuity services that maintain access during outages, and security awareness training for end users. The platform generates detailed message logs that capture the full delivery journey of every email, including threat verdicts, URL rewrite history, and attachment sandbox results. These logs are a valuable source for SOC investigations involving email-based attack vectors.

How does Mimecast work with Qevlar?

Qevlar integrates with Mimecast to retrieve email threat data during phishing and BEC investigations. When an alert involves a suspicious email campaign, Qevlar can query Mimecast logs to identify the full scope of delivery, determine which users were targeted, and retrieve sandbox verdicts for any associated attachments or URLs.