Impersonation Protection configuration.
Required application permissions: Monitoring | Impersonation Protection | Read.
External DocumentationTo learn more, visit the Mimecast documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Search By Actions | Specify actions to search by. |
| Search By Field | Specify the field to be used for filtering the Search Query.Note: If this parameter is provided, Search Query must be specified. |
| Search By Identifiers | Search logs by identifiers. |
| Search Query | Provide a query to search in the logs. Note: If Search By Field is provided, this parameter must be specified. |
| Tagged Malicious | Determines whether to return only messages that are tagged as malicious. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Search By End Date | The end date of logs to return. The default is the execution time. |
| Search By Start Date | The start date of logs to return. The default is the start of the current day. |
| Sort Descending | Determines whether to order results with the most recent first. |
Example Output
{
"data": {
"impersonationLogs": [
{
"action": "string",
"definition": "string",
"eventTime": "yyyy-MM-dd'T'HH:mm:ssZ",
"hits": 0,
"id": "string",
"identifiers": [
"similar_internal_domain",
"newly_observed_domain",
"internal_user_name",
"reply_address_mismatch",
"targeted_threat_dictionary",
"custom_external_domain",
"mimecast_external_domain",
"advanced_similar_internal_domain",
"advanced_custom_external_domain",
"advanced_mimecast_external_domain",
"custom_name_list"
],
"impersonationResults": [
"string"
],
"messageId": "string",
"recipientAddress": "string",
"senderAddress": "string",
"senderIpAddress": "string",
"subject": "string",
"taggedExternal": true,
"taggedMalicious": true
}
],
"resultCount": 0
},
"fail": [
{
"errors": [
{
"code": "string",
"message": "string",
"retryable": true
}
],
"key": {
"actions": [
"hold",
"bounce",
"none"
],
"from": "yyyy-MM-dd'T'HH:mm:ssZ",
"identifiers": [
"similar_internal_domain",
"newly_observed_domain",
"internal_user_name",
"reply_address_mismatch",
"targeted_threat_dictionary",
"custom_external_domain",
"mimecast_external_domain",
"advanced_similar_internal_domain",
"advanced_custom_external_domain",
"advanced_mimecast_external_domain",
"custom_name_list"
],
"oldestFirst": true,
"query": "string",
"searchField": "all",
"taggedMalicious": false,
"to": "yyyy-MM-dd'T'HH:mm:ssZ"
}
}
]
}