mimecast/email-security Dashboards | Integrations | LogScale Documentation

Skip to content

LogScale Documentation Full Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL API Contacting Support

Reading time: 5 minutes

mimecast/email-security Dashboards

Attachment Protect

Widget	Description	Type
Threats detected	Displays a table of detected threats and accompanying details using TTP attachment logs. Hide Query Show Query logscale `#source=ttp-attachment-logs \| fileExtension := splitString(field=fileType, by="/", index=1) \| table(["date","senderAddress", "recipientAddress","route", "fileName",fileExtension, "fileType"]) \| rename(fileType, as="File Mime Type") \| rename(fileExtension, as="File Type") \| sort(field=date, order=desc)`	`Table`
Threats detected by recipient	Displays a table of threats detected by recipient using TTP attachment logs. Hide Query Show Query logscale `#source=ttp-attachment-logs \| result=malicious \| groupby(field=recipientAddress, function=count()) \| sort()`	`Table`
Threats detected by file extension	Displays a table of threats detected by file extension using TTP attachment logs. Hide Query Show Query logscale `#source=ttp-attachment-logs \| fileType:= splitString(field=fileType, by="/", index=1) \| groupby(fileType, function=count()) \| sort()`	`Table`
Threats detected over time	Displays a list of TTP-protected email attachments that are considered threats over a one week timespan. Hide Query Show Query logscale `#source=ttp-attachment-logs \| result=malicious \| timechart(span=1week, function=count())`	`Time Chart`
Threats detected by sending domain	Displays a table of threats detected and associated domain data using TTP attachment logs. Hide Query Show Query logscale `#source=ttp-attachment-logs \| groupby(field=senderAddress, function=count())`	`Table`

Audit Log

Widget Description Type

Displays a table of the most recent audit log entries in descending order arranged by user and event time.

Show Query

Data Leak Prevention

Widget	Description	Type
Policies	Displays a table of a system's policies using DLP logs. Hide Query Show Query logscale `#source=dlp-logs \| groupby(field=policy, function=count()) \| sort()`	`Table`
Senders	Displays a list of senders by email address using DLP logs. Hide Query Show Query logscale `#source=dlp-logs \| groupby(field=senderAddress, function=count()) \| sort()`	`Table`
Actions	Displays a table of actions using DLP logs. Hide Query Show Query logscale `#source=dlp-logs \| groupby(field=action, function=count()) \| sort()`	`Table`
Events	Displays a list of events using DLP logs over the span of one week. Hide Query Show Query logscale `#source=dlp-logs \| timechart(span=1week, function=count())`	`Time Chart`

Email Activity Summary

Widget	Description	Type
Email Traffic	Displays a chart of email traffic over a 1 week timespan using SIEM logs. Hide Query Show Query logscale `(#source=siem-delivery-logs or #source=siem-receipt-logs) \| timechart(span=1week,series=Dir, function=count())`	`Time Chart`
Held	Displays a table of held email traffic using SIEM process logs. Hide Query Show Query logscale `#source=siem-process-logs\| Act=Hld \| groupby(field=Hld, function=count()) \| sort()`	`Table`
Rejections	Displays a table of rejections by type using SIEM receipt logs. Hide Query Show Query logscale `#source=siem-receipt-logs \| groupBy(field=RejType, function=count()) \| sort()`	`Table`
Delivery Failures	Displays a list of delivery failures using SIEM receipt logs. Hide Query Show Query logscale `(#source=siem-delivery-logs or #source=siem-receipt-logs) \| Delivered=false \| groupby(field=RejType) \| sort()`	`Table`

Impersonation Protect

Widget	Description	Type
Top Potencial Malicious Server	Displays a table of top potential malicious server attacks grouped by sender address using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| taggedMalicious=true \| groupby(field=senderAddress, function=count()) \| sort()`	`Table`
Newly Observed Domain	Displays a list of newly observed domains using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| /newly_observed_domain/ \| count()`	`Gauge`
Targeted ThreatDictionary Detected	Displays detected threat dictionaries that have been targeted using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| /targeted_threat_dictionary/ \| count()`	`Gauge`
Top Potencial Target Recipients	Displays a table of the top potential target recipients using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| taggedMalicious=true \| groupby(field=recipientAddress, function=count()) \| sort()`	`Table`
Similar Internal Domain Detected	Displays a list of detected internal domains that are similar using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| /advanced_similar_internal_domain/ \| count()`	`Gauge`
Reply Mismatch Detected	Displays reply address mismatches using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| /reply_address_mismatch/ \| count()`	`Gauge`
Internal User Name Detected	Displays a list of internal usernames detected using TTP impersonation logs. Hide Query Show Query logscale `#source=ttp-impersonation-logs \| identifiers \| /internal_user_name/ \| count()`	`Gauge`

Threat Intel Feed - Regional

Widget	Description	Type
Regional Threats by file extension	Displays a table of regional threats organized by file extension. Hide Query Show Query logscale `#source=threat-intel-feed-malware-grid \| fileType:= splitString(field=FileMimeType, by="/", index=1) \| groupby(fileType, function=count()) \| sort()`	`Table`
Regional Threats by file size	Displays a table of regional threats by file size. Hide Query Show Query logscale `#source=threat-intel-feed-malware-grid \| groupby(field=FileSize, function=count()) \| sort()`	`Table`
Regional Threats - Raw Data	Displays a table of regional threats and their raw data, including file name, file MIME type, file size, etc. in descending order by timestamp. Hide Query Show Query logscale `#source = threat-intel-feed-malware-grid \| table(["Timestamp","FileName", "FileMimeType", "FileSize", "Route", "SHA1", "SHA256", "SendingIP"]) \| sort(field=Timestamp, order=desc)`	`Table`
Regional Threats World Map by Sending IP	Displays a world map of regional threats by the sender's IP address. Hide Query Show Query logscale `#source = threat-intel-feed-malware-grid \| worldMap(ip=SendingIP)`	`World Map`
Regional Threats detected over time	Displays a list of regional threats over a one week timespan. Hide Query Show Query logscale `#source=threat-intel-feed-malware-grid \| timechart(span=1week, function=count())`	`Time Chart`
Regional Threats by file name	Displays a list of regional malware threats from an Intel feed malware grid by file name. Hide Query Show Query logscale `#source=threat-intel-feed-malware-grid \| groupby(field=FileName, function=count()) \| sort()`	`Table`

Threat Intel Feed - Targeted

Widget	Description	Type
Targeted Threats over time	Displays a chart of targeted threats over a 1 week timespan. Hide Query Show Query logscale `#source=threat-intel-feed-malware-customer \| timeChart(span=1week, function=count())`	`Time Chart`
Targeted Threats by file extension	Displays a list of targeted threats by file extension. Hide Query Show Query logscale `#source=threat-intel-feed-malware-customer \| fileType:= splitString(field=FileMimeType, by="/", index=1) \| groupby(fileType, function=count()) \| sort()`	`Table`
Targeted Threats by file name	Displays a table of targeted threats by file name. Hide Query Show Query logscale `#source=threat-intel-feed-malware-customer \| groupby(field=FileName, function=count()) \| sort()`	`Table`
Targeted Threats by file size	Displays a table of targeted threats by file size. Hide Query Show Query logscale `#source=threat-intel-feed-malware-customer \| groupby(field=FileSize, function=count()) \| sort()`	`Table`
Targeted Threats Detected - Raw Data	Displays a table of targeted threats detected and the raw data associated in descending order with associated timestamps. Hide Query Show Query logscale `#source = threat-intel-feed-malware-customer \| table(["Timestamp","FileName", "FileMimeType", "FileSize", "Route", "SHA1", "SHA256", "SendingIP"]) \| sort(field=Timestamp, order=desc)`	`Table`

URL Protect

Widget	Description	Type
Malicious vs clean logs over time	Displays a chart of malicious vs clean TTP URL logs over a one week timespan. Hide Query Show Query logscale `#source=ttp-url-logs \| timechart(span=1week, series=scanResult, function=count())`	`Time Chart`
Top Malicious URLs	Displays a table of top malicious URLs using TTP URL logs. Hide Query Show Query logscale `#source=ttp-url-logs \| scanResult=malicious \| groupby(field=url, function=count()) \| sort()`	`Table`
Top URL Categories	Displays a table of top malicious URL categories using TTP logs. Hide Query Show Query logscale `#source=ttp-url-logs \| scanResult=malicious \| groupby(field=category, function=count())`	`Table`
Most recent URL Logs	Displays a table of a user's most recent URL logs and associated data in descending order using TTP URL logs. Hide Query Show Query logscale `#source=ttp-url-logs \| table(["date", "category","userEmailAddress", "url", "userAwarenessAction", "route", "userOverride", "adminOverride", "scanResult"]) \| sort(field=date, order=desc) \|`	`Table`

Enter search term