Incydr Flow: Mimecast

Updated

Overview

This article explains how to configure the Incydr Flow for Mimecast, which syncs membership between Incydr watchlists and Mimecast profile groups. Specifically, the Mimecast Flow enables you to do one or both of the following:

  • Create an Incydr watchlist from a Mimecast profile group, and push membership from Mimecast to Incydr. Members added to an Incydr watchlist are subject to Incydr preventative controls configured for that watchlist.
  • Create a Mimecast profile group from an Incydr watchlist, and push membership from Incydr to Mimecast. Members added to a Mimecast profile group are subject to Mimecast email controls for that group.

Follow the steps below to complete the required Mimecast and Incydr setup for configuring the Flow.

Considerations

  • You must be licensed for the Mimecast Flow to complete the steps below. Contact your Customer Value Manager (CVM) if you have questions about licensing.
  • Usernames in Mimecast and Incydr must be the same email address for a user to sync between the two systems. If the Flow can't resolve a username, that user isn't managed, and the username is included in the error report sent to the configured recipient.
  • You can't sync an existing Mimecast profile group with an existing Incydr watchlist. The Flow always creates a new watchlist and/or profile group, then syncs membership between it and the group or watchlist you specified.
  • Do not supply a watchlist or profile group created by this Flow as the source for pushing membership to the other. The Flow matches watchlists and profile groups by name, so configuring both directions to point at the same object causes each to overwrite the other's membership changes, producing unpredictable results.
  • Do not rename an Incydr watchlist or Mimecast profile group that is included in the Flow. The Flow configuration depends on static names, so changing the name will cause a new watchlist or profile group to be re-created with the original name.

Step 1: Mimecast configuration

Work with your Mimecast administrator to complete the steps below. For more information, see Mimecast's API & Integrations - Managing API Applications documentation.

Create a role for the API client

  1. Sign in to the Mimecast administration console.
  2. Go to Account > Admin Roles.
  3. Select New Role.
  4. Under Properties, complete these fields:
    • Role Name: Incydr Flows API Role
    • Description: API client role for the Incydr Flows integration
  5. Under Security Permission, select the Manage Application Roles radio button.
  6. Under Application Permissions, all permissions are selected by default. To follow the principle of least privilege, deselect every section, then select only these permissions:
    • Gateway Menu > Policies: Read and Edit
    • Services Menu > Directory Sync: Edit
    • Directories Menu > Groups: Read and Edit
  7. Click Save and Exit.

Create an API key and secret

  1. In the Mimecast administration console, go to Integrations > API and Platform Integrations.
  2. Under the Mimecast API 2.0 tile, click Generate Keys.
  3. Select Create New Integration.
  4. Under Details, complete these fields:
    • Application Name: Incydr Flow
    • Products: Select Policy Management and User and Group Management.
    • Application Role: Select the role you created above.
    • Description: The API client for the Incydr Flow and Mimecast integration
  5. Under Notification Settings, enter a technical point of contact name and email address.
  6. Click Save.
  7. Save the API key and secret in a secure location for future reference.
    The Mimecast API credentials are required to initially enable the Flow in the Incydr console, as well as to update settings after the initial setup.

Identify profile groups to sync

If you want to sync membership from Mimecast to Incydr, identify the Mimecast profile groups to include in the Flow.

  1. In the Mimecast administration console, go to Users & Groups > Profile Groups.
  2. Identify the profile groups you want to sync to Incydr and record the exact profile group names. Profile group names are case sensitive.

Step 2: Incydr configuration

API client setup

Create a new Incydr API client:

  1. Sign in to the Incydr console.
  2. Go to Administration > Integrations > API Clients.
  3. Select Create new API client.
  4. Enter a name specific to this flow (for example, "Mimecast Flow").
  5. Add these permissions:
    • Detection lists - Read and Write
    • User - Read
  6. Click Save.
  7. Save the Client ID, Secret, and Base URL in a secure location for future reference.
    The Incydr API client credentials are required to initially enable the Flow in the Incydr console, as well as to update settings after the initial setup.

Determine watchlists to sync

If you want to sync membership from Incydr to Mimecast, identify the Incydr watchlists to include in the Flow.

  1. In the Incydr console, go to User Activity > Watchlists.
  2. For each watchlist you want to include, select the watchlist name.
    The watchlist details appear.
  3. From the watchlist details, copy the ID at the end of the browser URL. For example, in the URL https://console.us2.code42.com/app/#/detection/watchlists/detail/d189b9bb-8f8f-454c, the watchlist ID is d189b9bb-8f8f-454c.
  4. Copy and save the watchlist IDs for all watchlists you want to include in the Flow. 

Mimecast Flow setup

  1. In the Incydr console, go to Administration > Integrations > Incydr Flows.
  2. From the list of Flows, select the Mimecast watchlist management flow.
  3. Complete these fields:
    • Mimecast API key: Enter the Mimecast API key obtained above in step 1.
    • Mimecast API secret: Enter the Mimecast API secret obtained above in step 1.
    • Mimecast profile groups: (Optional) Enter the profile group names identified above in step 1. The corresponding Incydr watchlist is created using the naming convention Mimecast - <profile group name>.
    • Code42 Client ID: Enter the Incydr API Client ID obtained above in step 2.
    • Code42 Client Secret: Enter the Incydr API Client Secret obtained above in step 2.
    • Code42 Base URL: Enter the Base URL obtained in step 2 above. You can also obtain the Base URL by identifying the URL for your Incydr cloud environment. This field is populated by default.
    • Code42 watchlist IDs: (Optional) Enter the watchlist IDs identified above in step 2. The corresponding Mimecast profile group is created using the naming convention Code42 - <watchlist name>.
    • Code42 watchlist IDs to add to the Blocked Senders policy: (Optional) Enter any watchlist IDs, from the list entered above, that should also apply Mimecast's Blocked Senders policy to their synced profile group.
      This must be a subset of the Code42 watchlist IDs entered above.
    • Recipient email address for error report: Specify an email address to receive reports when a username can't be resolved between Mimecast and Incydr. If not provided, no emails are sent.
    • Scheduled interval in minutes: Select how often to run the Flow and process changes. 
      The default is 60 minutes, but because this Flow can apply email controls to synced users, consider setting a shorter interval so controls are applied as quickly as possible.
  4. Click Submit.

Related topics

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.