Get TTP Impersonation Protect Logs - BlinkOps Documentation

Get messages containing information flagged by an Impersonation Protection configuration. Required application permissions: Monitoring | Impersonation Protection | Read.

External DocumentationTo learn more, visit the Mimecast documentation.

Basic Parameters

Parameter	Description
Search By Actions	Specify actions to search by.
Search By Field	Specify the field to be used for filtering the `Search Query`. Note: If this parameter is provided, `Search Query` must be specified.
Search By Identifiers	Search logs by identifiers.
Search Query	Provide a query to search in the logs. Note: If `Search By Field` is provided, this parameter must be specified.
Tagged Malicious	Determines whether to return only messages that are tagged as malicious.

Advanced Parameters

Parameter	Description
Search By End Date	The end date of logs to return. The default is the execution time.
Search By Start Date	The start date of logs to return. The default is the start of the current day.
Sort Descending	Determines whether to order results with the most recent first.

Example Output

{
	"data": {
		"impersonationLogs": [
			{
				"action": "string",
				"definition": "string",
				"eventTime": "yyyy-MM-dd'T'HH:mm:ssZ",
				"hits": 0,
				"id": "string",
				"identifiers": [
					"similar_internal_domain",
					"newly_observed_domain",
					"internal_user_name",
					"reply_address_mismatch",
					"targeted_threat_dictionary",
					"custom_external_domain",
					"mimecast_external_domain",
					"advanced_similar_internal_domain",
					"advanced_custom_external_domain",
					"advanced_mimecast_external_domain",
					"custom_name_list"
				],
				"impersonationResults": [
					"string"
				],
				"messageId": "string",
				"recipientAddress": "string",
				"senderAddress": "string",
				"senderIpAddress": "string",
				"subject": "string",
				"taggedExternal": true,
				"taggedMalicious": true
			}
		],
		"resultCount": 0
	},
	"fail": [
		{
			"errors": [
				{
					"code": "string",
					"message": "string",
					"retryable": true
				}
			],
			"key": {
				"actions": [
					"hold",
					"bounce",
					"none"
				],
				"from": "yyyy-MM-dd'T'HH:mm:ssZ",
				"identifiers": [
					"similar_internal_domain",
					"newly_observed_domain",
					"internal_user_name",
					"reply_address_mismatch",
					"targeted_threat_dictionary",
					"custom_external_domain",
					"mimecast_external_domain",
					"advanced_similar_internal_domain",
					"advanced_custom_external_domain",
					"advanced_mimecast_external_domain",
					"custom_name_list"
				],
				"oldestFirst": true,
				"query": "string",
				"searchField": "all",
				"taggedMalicious": false,
				"to": "yyyy-MM-dd'T'HH:mm:ssZ"
			}
		}
	]
}

Workflow Library Example

Get Ttp Impersonation Protect Logs with Mimecast and Send Results Via Email

Preview this Workflow on desktop

​Basic Parameters

​Advanced Parameters

​Example Output

​Workflow Library Example

Basic Parameters

Advanced Parameters

Example Output

Workflow Library Example