Required application permissions: Monitoring | Impersonation Protection | Read.

To learn more, visit the Mimecast documentation.

​
Basic Parameters​

ParameterDescription
Search By ActionsSpecify actions to search by.
Search By FieldSpecify the field to be used for filtering the Search Query.Note: If this parameter is provided, Search Query must be specified.
Search By IdentifiersSearch logs by identifiers.
Search QueryProvide a query to search in the logs.Note: If Search By Field is provided, this parameter must be specified.
Tagged MaliciousDetermines whether to return only messages that are tagged as malicious.

​
Advanced Parameters​

ParameterDescription
Search By End DateThe end date of logs to return. The default is the execution time.
Search By Start DateThe start date of logs to return. The default is the start of the current day.
Sort DescendingDetermines whether to order results with the most recent first.

​
Example Output​

{    "data": {        "impersonationLogs": [            {                "action": "string",                "definition": "string",                "eventTime": "yyyy-MM-dd'T'HH:mm:ssZ",                "hits": 0,                "id": "string",                "identifiers": [                    "similar_internal_domain",                    "newly_observed_domain",                    "internal_user_name",                    "reply_address_mismatch",                    "targeted_threat_dictionary",                    "custom_external_domain",                    "mimecast_external_domain",                    "advanced_similar_internal_domain",                    "advanced_custom_external_domain",                    "advanced_mimecast_external_domain",                    "custom_name_list"                ],                "impersonationResults": [                    "string"                ],                "messageId": "string",                "recipientAddress": "string",                "senderAddress": "string",                "senderIpAddress": "string",                "subject": "string",                "taggedExternal": true,                "taggedMalicious": true            }        ],        "resultCount": 0    },    "fail": [        {            "errors": [                {                    "code": "string",                    "message": "string",                    "retryable": true                }            ],            "key": {                "actions": [                    "hold",                    "bounce",                    "none"                ],                "from": "yyyy-MM-dd'T'HH:mm:ssZ",                "identifiers": [                    "similar_internal_domain",                    "newly_observed_domain",                    "internal_user_name",                    "reply_address_mismatch",                    "targeted_threat_dictionary",                    "custom_external_domain",                    "mimecast_external_domain",                    "advanced_similar_internal_domain",                    "advanced_custom_external_domain",                    "advanced_mimecast_external_domain",                    "custom_name_list"                ],                "oldestFirst": true,                "query": "string",                "searchField": "all",                "taggedMalicious": false,                "to": "yyyy-MM-dd'T'HH:mm:ssZ"            }        }    ]}

​
Workflow Library Example​

Get Ttp Impersonation Protect Logs with Mimecast and Send Results Via Email

Preview this Workflow on desktop

Get Rejection LogsGet TTP URL Logs