mimecast/email-security Dashboards

Attachment protect

The Attachment Protect dashboard provides comprehensive email attachment threat analysis through detailed threat detection visualizations. This dashboard enables monitoring of malicious attachments, analysis of file-based threats by extension, and tracking of threat patterns across email communications.
Audit log

The Audit Log dashboard presents detailed system activity monitoring through chronological event tracking visualizations. This dashboard enables review of user activities, tracking of system changes, and investigation of security events across the email security environment.
Awareness training

The Awareness Training dashboard provides comprehensive security training analytics through detailed performance measurement visualizations. This dashboard enables tracking of phishing simulation results, monitoring of user engagement metrics, and assessment of training effectiveness across the organization.
Data leak prevention

The Data Leak Prevention dashboard presents comprehensive DLP policy enforcement through detailed event monitoring visualizations. This dashboard enables tracking of policy violations, analysis of sender behaviors, and monitoring of protective actions across email communications.
Email activity summary

The Email Activity Summary dashboard provides comprehensive email traffic analysis through multi-dimensional monitoring visualizations. This dashboard enables tracking of message flow patterns, investigation of delivery issues, and monitoring of email processing activities across the environment.
Impersonation protect

The Impersonation Protect dashboard presents advanced impersonation threat detection through detailed security monitoring visualizations. This dashboard enables identification of malicious domains, analysis of targeted attacks, and tracking of suspicious sender patterns across email communications.
Threat intel feed - regional

The Threat Intel Feed - Regional dashboard provides geographic-based threat intelligence through targeted monitoring visualizations. This dashboard enables tracking of regional threat patterns, analysis of malware distributions, and monitoring of location-specific security incidents across the environment.
Threat intel feed - targeted

The Threat Intel Feed - Targeted dashboard presents focused threat intelligence analysis through specialized tracking visualizations. This dashboard enables monitoring of targeted attack patterns, analysis of specific threat campaigns, and investigation of strategic threat activities across the infrastructure.
URL protect

The URL Protect dashboard provides comprehensive URL-based threat analysis through detailed security monitoring visualizations. This dashboard enables tracking of malicious URLs, analysis of URL categories, and monitoring of web-based threats across email communications.

Attachment protect

The Attachment Protect dashboard provides comprehensive email attachment threat analysis through detailed threat detection visualizations. This dashboard enables monitoring of malicious attachments, analysis of file-based threats by extension, and tracking of threat patterns across email communications.

Widget	Description	Type
Threats detected	Displays a table of detected threats and accompanying details using TTP attachment logs. Hide Query Show Query logscale #Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-attachment-logs" \| Vendor.result="malicious" \| "File type" := splitString(field="file.mime_type", by="/", index=1) \| table(["Vendor.date", "email.sender.address", "email.to.address[0]", "email.direction", "file.name", "File type", "file.mime_type"]) \| rename(field=[["Vendor.date", "Date"], ["email.sender.address", "Sender"], ["email.to.address[0]", "Recipient"], ["email.direction", "Route"], ["file.name", "File name"], ["file.mime_type", "File mime type"]]) \| sort(field="Date", order=desc)	`Table`
Threats detected by recipient	Displays a table of threats detected by recipient using TTP attachment logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-attachment-logs" \| Vendor.result="malicious" \| groupBy(field="email.to.address[0]", function=count(as="Event count")) \| rename(field="email.to.address[0]", as="Recipient") \| sort("Event count")`	`Table`
Threats detected by file extension	Displays a table of threats detected by file extension using TTP attachment logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-attachment-logs" \| Vendor.result="malicious" \| "File type" := splitString(field="file.mime_type", by="/", index=1) \| groupBy("File type", function=count(as="Event count")) \| sort("Event count")`	`Table`
Threats detected over time	Displays a list of TTP-protected email attachments that are considered threats over a one week timespan. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-attachment-logs" \| Vendor.result="malicious" \| timeChart(span="1week", function=count(as="Event count"))`	`Time Chart`
Threats detected by sending domain	Displays a table of threats detected and associated domain data using TTP attachment logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-attachment-logs" \| Vendor.result="malicious" \| groupBy(field="email.sender.address", function=count(as="Event count")) \| rename(field="email.sender.address", as="Sender") \| sort("Event count")`	`Table`

Audit log

The Audit Log dashboard presents detailed system activity monitoring through chronological event tracking visualizations. This dashboard enables review of user activities, tracking of system changes, and investigation of security events across the email security environment.

Widget Description Type

Widget	Description	Type
Most recent audit log entries	Displays a table of the most recent audit log entries in descending order arranged by user and event time. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.audit-events" \| table(["Vendor.eventTime", "Vendor.user", "Vendor.auditType", "Vendor.eventInfo"]) \| rename(field=[["Vendor.eventTime", "Event time"], ["Vendor.user", "User"], ["Vendor.auditType", "Audit type"], ["Vendor.eventInfo", "Event info"]]) \| sort(field="Event time", order="desc")`	`Table`

Displays a table of the most recent audit log entries in descending order arranged by user and event time.

Hide Query

Show Query

logscale

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.audit-events"
| table(["Vendor.eventTime", "Vendor.user", "Vendor.auditType", "Vendor.eventInfo"])
| rename(field=[["Vendor.eventTime", "Event time"], ["Vendor.user", "User"], ["Vendor.auditType", "Audit type"], ["Vendor.eventInfo", "Event info"]])
| sort(field="Event time", order="desc")

Table

Awareness training

The Awareness Training dashboard provides comprehensive security training analytics through detailed performance measurement visualizations. This dashboard enables tracking of phishing simulation results, monitoring of user engagement metrics, and assessment of training effectiveness across the organization.

Widget	Description	Type
Breakdown by number of correct answers	Displays a table of count of users based on the correctly answered phishing training. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.numCorrectAnswers"], function=count(as="User count")) \| rename(field="Vendor.numCorrectAnswers", as="Correct answers")`	`Table`
Users clicked on phishing data	Displays a table showing details of users who clicked on phishing links. Hide Query Show Query logscale #Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.status="CLICKED" \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| table(["Vendor.email", "Vendor.reactionTime", "Vendor.timeClicked", "Vendor.timeOpened", "Vendor.templateName"], sortby="Vendor.reactionTime") \| rename(field=[["Vendor.email", "Email"], ["Vendor.reactionTime", "Reaction time"], ["Vendor.timeClicked", "Clicked timestamp"], ["Vendor.timeOpened", "Opened timestamp"], ["Vendor.templateName", "Template name"]])	`Table`
Breakdown by watchlist count	Displays a table of a count of users based on the number of videos in the watchlist. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-watchlist-details" \| Vendor.email=* \| groupBy(["Vendor.email"], function=tail(1)) \| groupBy(["Vendor.watchlistCount"], function=count(as="User count")) \| rename(field="Vendor.watchlistCount", as="Watchlist videos")`	`Table`
Breakdown by number of campaigns clicked	Displays a table of a count of users based on the phishing links clicked by the user. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.numCampaignsClicked"], function=count(as="User count")) \| rename(field="Vendor.numCampaignsClicked", as="Phishing clicks")`	`Table`
Breakdown by correct number	Displays a table of a count of users based on the correctly answered questions. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-performance-details" \| Vendor.email=* \| groupBy(["Vendor.email"], function=tail(1)) \| groupBy(["Vendor.numCorrect"], function=count(as="User count")) \| rename(field="Vendor.numCorrect", as="Correct video answers")`	`Table`
Breakdown by number of campaigns sent	Displays a table of a count of users based on the number of campaigns sent to users. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.numCampaignsSent"], function=count(as="User count")) \| rename(field="Vendor.numCampaignsSent", as="Phishing campaigns sent")`	`Table`
Breakdown by incorrect number	Displays a table of a count of users based on the incorrectlu answered questions. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-performance-details" \| Vendor.email=* \| groupBy(["Vendor.email"], function=tail(1)) \| groupBy(["Vendor.numIncorrect"], function=count(as="User count")) \| rename(field="Vendor.numIncorrect", as="Incorrect video answers")`	`Table`
Breakdown by number of incorrect answers	Displays a table of count of users based on the incorrectly answered phishing training. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.numIncorrectAnswers"], function=count(as="User count")) \| rename(field="Vendor.numIncorrectAnswers", as="Incorrect answers")`	`Table`
Breakdown by template name	Displays a table of a count of users based on template name. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.templateName"], function=count(as="User count")) \| rename(field="Vendor.templateName", as="Template name") \| sort("User count")`	`Table`
Breakdown by number of training modules assigned	Displays a table of a count of users based on the number of training modules assigned to users. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.numTrainingModulesAssigned"], function=count(as="User count")) \| rename(field="Vendor.numTrainingModulesAssigned", as="Training modules assigned")`	`Table`
Breakdown by number not watched	Displays a table of a count of users based on number of unwateched videos. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-performance-details" \| Vendor.email=* \| groupBy(["Vendor.email"], function=tail(1)) \| groupBy(["Vendor.numNotWatched"], function=count(as="User count")) \| rename(field="Vendor.numNotWatched", as="Unwatched videos")`	`Table`
Breakdown by clicked IP	Displays a table of a count of users based on IP address from where the click was made. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.awareness-training-user-data" \| Vendor.email=* \| Vendor.templateName=?template-name \| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1)) \| groupBy(["Vendor.clickedIp"], function=count(as="User count")) \| rename(field="Vendor.clickedIp", as="Clicked IP")`	`Table`
parameter-panel-1745316094934-0		parameterPanel

Data leak prevention

The Data Leak Prevention dashboard presents comprehensive DLP policy enforcement through detailed event monitoring visualizations. This dashboard enables tracking of policy violations, analysis of sender behaviors, and monitoring of protective actions across email communications.

Widget	Description	Type
Policies	Displays a table of a system's policies using DLP logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.dlp-logs" \| groupBy(field="rule.name", function=count(as="Event count")) \| rename(field="rule.name", as="Policy") \| sort("Event count")`	`Table`
Senders	Displays a list of senders by email address using DLP logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.dlp-logs" \| groupBy(field="email.sender.address", function=count(as="Event count")) \| rename(field="email.sender.address", as="Sender email") \| sort("Event count")`	`Table`
Actions	Displays a table of actions using DLP logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.dlp-logs" \| groupBy(field="event.action", function=count(as="Event count")) \| rename(field="event.action", as="Action") \| sort("Event count")`	`Table`
Events	Displays a list of events using DLP logs over the span of one week. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.dlp-logs" \| timeChart(span="1week", function=count(as="Event count"))`	`Time Chart`

Email activity summary

The Email Activity Summary dashboard provides comprehensive email traffic analysis through multi-dimensional monitoring visualizations. This dashboard enables tracking of message flow patterns, investigation of delivery issues, and monitoring of email processing activities across the environment.

Widget	Description	Type
Email traffic	Displays a chart of email traffic over a 1 week timespan using SIEM logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset=~in(values=["emailsecurity.siem-delivery-logs", "emailsecurity.siem-receipt-logs"]) \| timeChart(span="1week", series="email.direction", function=count())`	`Time Chart`
Held	Displays a table of held email traffic using SIEM process logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.siem-process-logs" \| event.action="hld" \| groupBy(field="Vendor.holdReason", function=count(as="Event count")) \| rename(field="Vendor.holdReason", as="Hold reason") \| sort("Event count")`	`Table`
Rejections	Displays a table of rejections by type using SIEM receipt logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.siem-receipt-logs" \| event.action="rej" \| groupBy(field="Vendor.rejectionType", function=count(as="Event count")) \| rename(field="Vendor.rejectionType", as="Rejection type") \| sort("Event count")`	`Table`
Delivery failures	Displays a list of delivery failures using SIEM receipt logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset=~in(values=["emailsecurity.siem-delivery-logs", "emailsecurity.siem-receipt-logs"]) \| Vendor.delivered="false" \| groupBy(field="Vendor.rejectionType", function=count(as="Event count")) \| rename(field="Vendor.rejectionType", as="Rejection type") \| sort("Event count")`	`Table`
SIEM logs	Displays a chart of SIEM Logs over a 1 week timespan. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.siem*" \| timeChart(span="1week", series="#event.dataset", function=count())`	`Time Chart`

Impersonation protect

The Impersonation Protect dashboard presents advanced impersonation threat detection through detailed security monitoring visualizations. This dashboard enables identification of malicious domains, analysis of targeted attacks, and tracking of suspicious sender patterns across email communications.

Widget	Description	Type
Top potential malicious server	Displays a table of top potential malicious server attacks grouped by sender address using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| Vendor.taggedMalicious="true" \| groupBy(field="email.sender.address", function=count(as="Event count")) \| rename(field="email.sender.address", as="Sender") \| sort("Event count")`	`Table`
Newly observed domain	Displays a list of newly observed domains using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| @rawstring=/newly_observed_domain/ \| count()`	`Single Value`
Targeted threat dictionary detected	Displays detected threat dictionaries that have been targeted using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| @rawstring=/targeted_threat_dictionary/ \| count()`	`Single Value`
Top potential target recipients	Displays a table of the top potential target recipients using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| Vendor.taggedMalicious="true" \| groupBy(field="email.to.address[0]", function=count(as="Event count")) \| rename(field="email.to.address[0]", as="Recipient") \| sort("Event count")`	`Table`
Similar internal domain detected	Displays a list of detected internal domains that are similar using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| @rawstring=/advanced_similar_internal_domain/ \| count()`	`Single Value`
Reply mismatch detected	Displays reply address mismatches using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| @rawstring=/reply_address_mismatch/ \| count()`	`Single Value`
Internal user name detected	Displays a list of internal usernames detected using TTP impersonation logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-impersonation-logs" \| @rawstring=/internal_user_name/ \| count()`	`Single Value`

Threat intel feed - regional

The Threat Intel Feed - Regional dashboard provides geographic-based threat intelligence through targeted monitoring visualizations. This dashboard enables tracking of regional threat patterns, analysis of malware distributions, and monitoring of location-specific security incidents across the environment.

Widget Description Type

Widget	Description	Type
Regional threats detected over time	Displays a list of regional threats over a one week timespan. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.threat-intel-feed-malware-grid" \| timeChart(span="1week", function=count(as="Event count"))`	`Time Chart`
Regional threats by file name	Displays a list of regional malware threats from an Intel feed malware grid by file name. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.threat-intel-feed-malware-grid" \| groupBy(field="Vendor.name", function=count(as="Count")) \| rename(field="Vendor.name", as="File name") \| sort("Count")`	`Table`

Displays a list of regional threats over a one week timespan.

Hide Query

Show Query

logscale

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-grid"
| timeChart(span="1week", function=count(as="Event count"))

Time Chart

Displays a list of regional malware threats from an Intel feed malware grid by file name.

Hide Query

Show Query

logscale

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-grid"
| groupBy(field="Vendor.name", function=count(as="Count"))
| rename(field="Vendor.name", as="File name")
| sort("Count")

Table

Threat intel feed - targeted

The Threat Intel Feed - Targeted dashboard presents focused threat intelligence analysis through specialized tracking visualizations. This dashboard enables monitoring of targeted attack patterns, analysis of specific threat campaigns, and investigation of strategic threat activities across the infrastructure.

Widget Description Type

Widget	Description	Type
Targeted threats over time	Displays a chart of targeted threats over a 1 week timespan. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.threat-intel-feed-malware-customer" \| timeChart(span="1week", function=count(as="Event count"))`	`Time Chart`
Targeted threats by file name	Displays a table of targeted threats by file name. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.threat-intel-feed-malware-customer" \| groupBy(field="Vendor.name", function=count(as="Count")) \| rename(field="Vendor.name", as="File name") \| sort("Count")`	`Table`

Displays a chart of targeted threats over a 1 week timespan.

Hide Query

Show Query

logscale

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-customer"
| timeChart(span="1week", function=count(as="Event count"))

Time Chart

Displays a table of targeted threats by file name.

Hide Query

Show Query

logscale

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-customer"
| groupBy(field="Vendor.name", function=count(as="Count"))
| rename(field="Vendor.name", as="File name")
| sort("Count")

Table

URL protect

The URL Protect dashboard provides comprehensive URL-based threat analysis through detailed security monitoring visualizations. This dashboard enables tracking of malicious URLs, analysis of URL categories, and monitoring of web-based threats across email communications.

Widget	Description	Type
Malicious vs clean logs over time	Displays a chart of malicious vs clean TTP URL logs over a one week timespan. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-url-logs" \| timeChart(span="1week", series="Vendor.scanResult", function=count())`	`Time Chart`
Top malicious URLs	Displays a table of top malicious URLs using TTP URL logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-url-logs" \| Vendor.scanResult="malicious" \| groupBy(field="url.original", function=count(as="Count")) \| rename(field="url.original", as="URL") \| sort("Count")`	`Table`
Top URL categories	Displays a table of top malicious URL categories using TTP logs. Hide Query Show Query logscale `#Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-url-logs" \| Vendor.scanResult="malicious" \| groupBy(field="Vendor.category", function=count(as="Count")) \| rename(field="Vendor.category", as="Category") \| sort("Count")`	`Table`
Most recent URL logs	Displays a table of a user's most recent URL logs and associated data in descending order using TTP URL logs. Hide Query Show Query logscale #Vendor="mimecast" \| #event.module="emailsecurity" \| #event.dataset="emailsecurity.ttp-url-logs" \| table(["Vendor.date", "Vendor.category", "email.to.address[0]", "url.original", "Vendor.userAwarenessAction", "email.direction", "Vendor.userOverride", "Vendor.adminOverride", "Vendor.scanResult"]) \| rename(field=[["Vendor.date", "Date"], ["Vendor.category", "Category"], ["email.to.address[0]", "Recipient"], ["url.original", "URL"], ["Vendor.userAwarenessAction", "User awareness action"], ["email.direction", "Route"], ["Vendor.userOverride", "User override"], ["Vendor.adminOverride", "Admin override"], ["Vendor.scanResult", "Scan result"]]) \| sort(field="Date", order="desc")	`Table`

Versions of this Page

Package Marketplace

Package Reference

Dashboard Reference

Package Management

Other Integrations

Log Formats

mimecast/email-security Dashboards

Attachment protect

Audit log

Awareness training

Data leak prevention

Email activity summary

Impersonation protect

Threat intel feed - regional

Threat intel feed - targeted

URL protect

Enter search term