Web Security - Security Report

This article describes how to view the Security Report in Mimecast Web Security and is intended for use by Administrators.

It displays a log of security threat data, gathered from user activity in your organization, and allows you to:

• • • Apply specific filters to create a custom report.
    • Customize the data so that only the most relevant information displays.
    • Export specific data in a downloadable report.

Viewing the Security Report

You can view the Security Report by using the following steps:

1. Log on to the Mimecast Administration Console. 
2. Navigate to Web Security | Security Report. 

Changing the Date Range

You can change the Date Range within the Security Report screen by using the following steps:

1. Click on the Date Range drop-down.
2. Select the required Date Range (from the past 24 hours to the past 90 days, or select a Custom Range).

Searching for Security Report Data

You can search for data within the Security Report screen by using the following steps:

1. Enter known details in the Search field.
2. You can optionally click on the All drop-down field to filter the results by:

• • • All: No filter is applied, and all records are displayed.
    • User: Searches for the specified user.
    • Device Name: Searches for the specified device.
    • Public IP/Private IP: Searches the specified public/private IP where the request came from.
    • Request: Searches the URL or domain request.

3. Press the Enter key or click on the Search icon.

Filtering Security Report Data

The Security Report data can be filtered to focus on the details of specific activity.

You can filter within the Security Report screen by using the following steps:

1. Click on the Filters drop-down menu.
2. You can:

• • • Select one or more Discovery Method.
    • Select one or more Antivirus.
    • Select one or more Discovery Method.
    • Select New Domain.
    • Select Similarity Check.
    • Select one or more Security Category.

3. Click on the Apply button.

   Use the Select All/Deselect All links to toggle all selections and make small adjustments.

Customizing Data

All data associated with the Security Report is displayed in columns, which you can add/remove to enable you to focus on just the data you require.

You can customize the columns shown in the Security Report by using the following steps:

1. Click on the Gear icon. 
2. Select/deselect the Columns you want displayed:

• • • User: Displays the user who the request came from when using the Mimecast Security Agent.
    • Device Name: Displays the name of devices using the Mimecast Security Agent.
    • Private IP: Displays the private IP address that the request came from.
    • Threat: Displays the type of threat:
      • Anti Virus: A virus-related threat that was found to be infected or unscannable.
      • New Domain: A newly observed domain.
      • Similarity Check: A domain found to be similar to another known domain.
      • Security Category: A request matching a security-related category type.
    • Date/Time: Displays the date and time of the request.
    • Discovery Method: Displays the method used by the Mimecast Security Agent to find the user.

      For a full list of values, see the Identification Process section of Transparent User ID. This functionality forms part of the Mimecast Security Agent and removes the need for users to log into or interact with the Mimecast Security Agent by automatically identifying the domain user's primary email address.

    • Public IP: Displays the source IP the request came from.
    • Request: Displays the URL or domain of the site the user attempted to access.
    • Details: Displays the response to the threat.

3. Click on the Apply button.

Exporting Data

You can Export Data from the Security Report by using the following steps:

1. Click on the Export Data button.
2. Select the data Columns to Include in the export.
3. Select a File Format for the export file.
4. Click on the Download button.

Up to 10,000 items can be exported at a time.