Automated Response to Email Security Threats

When a suspicious email is detected by Mimecast, the alert is escalated to Smart SOAR and triggers a phishing playbook, which extracts all the elements of the email, including any attachments, URLs, and the sender’s domain. All those elements are then checked against integrated threat intelligence tools as well as past incidents to identify known malicious IOCs. If the incident is confirmed as a genuine threat, Smart SOAR can orchestrate a response through Mimecast and the rest of the security infrastructure, such as searching for the malicious file hash across other inboxes, blocking the sender, and retrieving any related emails that might be part of the same campaign.

With so many alerts in the typical environment, security teams need a way to filter out the noise without missing dangerous alerts. Analysts don’t have time to investigate every alert, so meaningful incidents are left in the queue while endless false positives take up all the time. By running all events from Mimecast and other detection tools through Smart SOAR’s Event Pipeline, security teams can automate data normalization, threat triage, and dismissal of benign events—eliminating up to 98% of events and keeping analysts focused on real threats. For email alerts ingested from Mimecast, this will include artifact extraction and correlation, de-duplication, threat intelligence enrichment, and assignment to the appropriate analyst if necessary.