> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mimecast integration setup

> Connect Mimecast to Living Security for email threat, click, delivery, and data-protection activity.

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

export const ConnectInPlatform = ({tile, children}) => <Step title="Enter the credentials in the Living Security Platform">
    <p>
      Completed by whoever holds Living Security access — the program owner, or the system
      admin if they've been invited (delegated setup).
    </p>
    <ol>
      <li>
        Go to <strong>Settings → Integrations → Catalog</strong>, find the{' '}
        <strong>{tile}</strong> tile, click <strong>Connect</strong>.
      </li>
      <li>
        Fill in the fields below, then click <strong>Connect</strong>.
      </li>
    </ol>
    {children}
  </Step>;

export const SystemAdminBanner = ({system, recommendDelegated}) => <Note>
    <p>
      <strong>This guide is for your {system} administrator.</strong> It covers creating API
      credentials inside {system}, which requires admin access to {system} — not to the
      Living Security Platform.
    </p>
    <p>
      If you're the Living Security <strong>program owner</strong> and don't administer {system},
      send this page to whoever does. They complete Part A and hand the credentials back to you
      (or enter them directly if you've invited them into the platform).
      {recommendDelegated && <>
          {' '}Because setup produces sensitive key material, we recommend the{' '}
          <strong>delegated setup</strong> path so the secret is never sent back to you.
        </>}
    </p>
  </Note>;

<SystemAdminBanner system="Mimecast" recommendDelegated={true} />

## What this integration contributes

Mimecast can contribute normalized email threat, click, delivery, and data-protection activity. Reviewed examples include:

* `phishing.real.clicked` — clicks links in real phishing emails
* `data.transfer.blocked` — data transfer blocked
* `phishing.real.delivered` — real phishing delivered to the inbox

See [how integration data becomes signals](/signals/data-sources).

## What Living Security needs

| Credential        | Description                                                |
| ----------------- | ---------------------------------------------------------- |
| **Client ID**     | The identifier for a Mimecast API 2.0 service application. |
| **Client secret** | The secret for that service application.                   |

Assign the application a role with **Monitoring → URL Protection → Read**. Living Security uses the OAuth 2.0 client-credentials flow and reads URL Protection click logs.

## Setup

<Steps>
  <Step title="Create a Mimecast service application">
    In the Mimecast Administration Console, create an API 2.0 service application for Living Security and use the client-credentials grant.
  </Step>

  <Step title="Assign the minimum read permission">
    Assign a role that includes **Monitoring → URL Protection → Read**, then record the client ID and client secret.
  </Step>

  <ConnectInPlatform tile="Mimecast">
    Enter the client ID and client secret, then connect.
  </ConnectInPlatform>
</Steps>

## Verify and troubleshoot

Verify that the connection can read URL Protection logs. An empty first result is expected when there were no recent protected-link clicks.

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    The client ID or secret is invalid, or the service application is disabled. Rotate the secret if necessary and reconnect.
  </Accordion>

  <Accordion title="403 Forbidden">
    Confirm that the role assigned to the service application includes **Monitoring → URL Protection → Read**.
  </Accordion>

  <Accordion title="No click activity">
    Confirm that URL Protection is enabled for the relevant mail flow and that the role applies to the account being queried.
  </Accordion>
</AccordionGroup>

For the endpoint permission, see [Mimecast's URL Protection log reference](https://developer.services.mimecast.com/docs/securityevents/1/routes/api%2Fttp%2Furl%2Fget-logs/post).

<PublicIntegrationNextSteps />