#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-attachment-logs"
| Vendor.result="malicious"
| "File type" := splitString(field="file.mime_type", by="/", index=1)
| table(["Vendor.date", "email.sender.address", "email.to.address[0]", "email.direction", "file.name", "File type", "file.mime_type"])
| rename(field=[["Vendor.date", "Date"], ["email.sender.address", "Sender"], ["email.to.address[0]", "Recipient"], ["email.direction", "Route"], ["file.name", "File name"], ["file.mime_type", "File mime type"]])
| sort(field="Date", order=desc)

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-attachment-logs"
| Vendor.result="malicious"
| groupBy(field="email.to.address[0]", function=count(as="Event count"))
| rename(field="email.to.address[0]", as="Recipient")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-attachment-logs"
| Vendor.result="malicious"
| "File type" := splitString(field="file.mime_type", by="/", index=1)
| groupBy("File type", function=count(as="Event count"))
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-attachment-logs"
| Vendor.result="malicious"
| timeChart(span="1week", function=count(as="Event count"))

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-attachment-logs"
| Vendor.result="malicious"
| groupBy(field="email.sender.address", function=count(as="Event count"))
| rename(field="email.sender.address", as="Sender")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.audit-events"
| table(["Vendor.eventTime", "Vendor.user", "Vendor.auditType", "Vendor.eventInfo"])
| rename(field=[["Vendor.eventTime", "Event time"], ["Vendor.user", "User"], ["Vendor.auditType", "Audit type"], ["Vendor.eventInfo", "Event info"]])
| sort(field="Event time", order="desc")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.numCorrectAnswers"], function=count(as="User count"))
| rename(field="Vendor.numCorrectAnswers", as="Correct answers")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.status="CLICKED"
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| table(["Vendor.email", "Vendor.reactionTime", "Vendor.timeClicked", "Vendor.timeOpened", "Vendor.templateName"], sortby="Vendor.reactionTime")
| rename(field=[["Vendor.email", "Email"], ["Vendor.reactionTime", "Reaction time"], ["Vendor.timeClicked", "Clicked timestamp"], ["Vendor.timeOpened", "Opened timestamp"], ["Vendor.templateName", "Template name"]])

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-watchlist-details"
| Vendor.email=*
| groupBy(["Vendor.email"], function=tail(1))
| groupBy(["Vendor.watchlistCount"], function=count(as="User count"))
| rename(field="Vendor.watchlistCount", as="Watchlist videos")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.numCampaignsClicked"], function=count(as="User count"))
| rename(field="Vendor.numCampaignsClicked", as="Phishing clicks")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-performance-details"
| Vendor.email=*
| groupBy(["Vendor.email"], function=tail(1))
| groupBy(["Vendor.numCorrect"], function=count(as="User count"))
| rename(field="Vendor.numCorrect", as="Correct video answers")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.numCampaignsSent"], function=count(as="User count"))
| rename(field="Vendor.numCampaignsSent", as="Phishing campaigns sent")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-performance-details"
| Vendor.email=*
| groupBy(["Vendor.email"], function=tail(1))
| groupBy(["Vendor.numIncorrect"], function=count(as="User count"))
| rename(field="Vendor.numIncorrect", as="Incorrect video answers")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.numIncorrectAnswers"], function=count(as="User count"))
| rename(field="Vendor.numIncorrectAnswers", as="Incorrect answers")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.templateName"], function=count(as="User count"))
| rename(field="Vendor.templateName", as="Template name")
| sort("User count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.numTrainingModulesAssigned"], function=count(as="User count"))
| rename(field="Vendor.numTrainingModulesAssigned", as="Training modules assigned")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-performance-details"
| Vendor.email=*
| groupBy(["Vendor.email"], function=tail(1))
| groupBy(["Vendor.numNotWatched"], function=count(as="User count"))
| rename(field="Vendor.numNotWatched", as="Unwatched videos")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.awareness-training-user-data"
| Vendor.email=*
| Vendor.templateName=?template-name
| groupBy(["Vendor.email", "Vendor.templateName"], function=tail(1))
| groupBy(["Vendor.clickedIp"], function=count(as="User count"))
| rename(field="Vendor.clickedIp", as="Clicked IP")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.dlp-logs"
| groupBy(field="rule.name", function=count(as="Event count"))
| rename(field="rule.name", as="Policy")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.dlp-logs"
| groupBy(field="email.sender.address", function=count(as="Event count"))
| rename(field="email.sender.address", as="Sender email")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.dlp-logs"
| groupBy(field="event.action", function=count(as="Event count"))
| rename(field="event.action", as="Action")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.dlp-logs"
| timeChart(span="1week", function=count(as="Event count"))

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset=~in(values=["emailsecurity.siem-delivery-logs", "emailsecurity.siem-receipt-logs"])
| timeChart(span="1week", series="email.direction", function=count())

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.siem-process-logs"
| event.action="hld"
| groupBy(field="Vendor.holdReason", function=count(as="Event count"))
| rename(field="Vendor.holdReason", as="Hold reason")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.siem-receipt-logs"
| event.action="rej"
| groupBy(field="Vendor.rejectionType", function=count(as="Event count"))
| rename(field="Vendor.rejectionType", as="Rejection type")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset=~in(values=["emailsecurity.siem-delivery-logs", "emailsecurity.siem-receipt-logs"])
| Vendor.delivered="false"
| groupBy(field="Vendor.rejectionType", function=count(as="Event count"))
| rename(field="Vendor.rejectionType", as="Rejection type")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.siem*"
| timeChart(span="1week", series="#event.dataset", function=count())

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| Vendor.taggedMalicious="true"
| groupBy(field="email.sender.address", function=count(as="Event count"))
| rename(field="email.sender.address", as="Sender")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| @rawstring=/newly_observed_domain/
| count()

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| @rawstring=/targeted_threat_dictionary/
| count()

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| Vendor.taggedMalicious="true"
| groupBy(field="email.to.address[0]", function=count(as="Event count"))
| rename(field="email.to.address[0]", as="Recipient")
| sort("Event count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| @rawstring=/advanced_similar_internal_domain/
| count()

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| @rawstring=/reply_address_mismatch/
| count()

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-impersonation-logs"
| @rawstring=/internal_user_name/
| count()

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-grid"
| timeChart(span="1week", function=count(as="Event count"))

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-grid"
| groupBy(field="Vendor.name", function=count(as="Count"))
| rename(field="Vendor.name", as="File name")
| sort("Count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-customer"
| timeChart(span="1week", function=count(as="Event count"))

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.threat-intel-feed-malware-customer"
| groupBy(field="Vendor.name", function=count(as="Count"))
| rename(field="Vendor.name", as="File name")
| sort("Count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-url-logs"
| timeChart(span="1week", series="Vendor.scanResult", function=count())

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-url-logs"
| Vendor.scanResult="malicious"
| groupBy(field="url.original", function=count(as="Count"))
| rename(field="url.original", as="URL")
| sort("Count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-url-logs"
| Vendor.scanResult="malicious"
| groupBy(field="Vendor.category", function=count(as="Count"))
| rename(field="Vendor.category", as="Category")
| sort("Count")

#Vendor="mimecast"
| #event.module="emailsecurity"
| #event.dataset="emailsecurity.ttp-url-logs"
| table(["Vendor.date", "Vendor.category", "email.to.address[0]", "url.original", "Vendor.userAwarenessAction", "email.direction", "Vendor.userOverride", "Vendor.adminOverride", "Vendor.scanResult"])
| rename(field=[["Vendor.date", "Date"], ["Vendor.category", "Category"], ["email.to.address[0]", "Recipient"], ["url.original", "URL"], ["Vendor.userAwarenessAction", "User awareness action"], ["email.direction", "Route"], ["Vendor.userOverride", "User override"], ["Vendor.adminOverride", "Admin override"], ["Vendor.scanResult", "Scan result"]])
| sort(field="Date", order="desc")