Add support for API 2.0 in Mimecast Event Collector #42498

kamalq97 · 2026-01-01T08:53:14Z

Related Issues

Description

Add support for Mimecast API 2.0 and implement async event fetching logic.

Version release notes:

Breaking Changes: Migrated from the legacy API 1.0 authentication method to OAuth2 client credentials flow for Mimecast API 2.0.

Added support for new API 2.0 authentication via the Client ID and Client Secret parameters.

Dropped support for API 1.0 authentication and removed the Application ID, Application Key, Access Key, and Secret Key parameters.

Breaking Changes: Removed the First fetch timestamp parameter. New integration instances will begin fetching events from the last minute.

Added support for the Fetch event types parameter that denotes the types of audit and SIEM events to fetch.

Added support for the siem_event_types, start_date, and end_date arguments in the !mimecast-get-events command.

Updated the Docker image to: demisto/py3-tools:1.0.0.6308650.

github-actions · 2026-01-01T08:59:45Z

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/Mimecast/Integrations/MimecastEventCollector
MimecastEventCollector.py	396	40	89%	104–105, 135–136, 145, 224–225, 228–230, 232–235, 238–242, 246–247, 251, 255, 258, 330, 410–411, 510, 586, 603, 607, 706–707, 816–817, 854–856, 954–955
TOTAL	396	40	89%

Tests	Skipped	Failures	Errors	Time
31	0 💤	0 ❌	0 🔥	8.649s ⏱️

content-bot · 2026-01-05T10:15:10Z

Validate summary
The following errors were thrown as a part of this pr: BC112, IN164.
The following errors cannot be ignored: BC112, IN164.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.
The following errors don't run as part of the nightly flow and therefore can be force merged: BC112, IN164.

Verdict: PR can be force merged from validate perspective? ✅

content-bot · 2026-01-05T11:09:57Z

🤖 Content-bot Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

content-bot

Hi there! Thanks for the update to the Mimecast pack. I've reviewed the changes and have a few points to discuss, primarily regarding the proxy implementation and test mocking.

Please ensure proxy arguments are passed correctly to the request methods rather than the aiohttp session, and update the unit tests to use AsyncMock for asynchronous methods. It would also be helpful to clarify the API 2.0 credential steps in the documentation and consolidate the breaking changes in the release notes.

Great work so far

@richardbluestone, @JasBeilin please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/ReleaseNotes/3_0_0.json

@@ -0,0 +1,4 @@
+{
+    "breakingChanges": true,
+    "breakingChangesNotes": "Migrated from the legacy API 1.0 authentication method to OAuth2 client credentials flow for Mimecast API 2.0. Integration instances must be re-configured using OAuth2 Client ID and Client Secret."


Consider adding the removal of the 'First fetch timestamp' parameter to the breaking changes notes.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/Integrations/MimecastEventCollector/MimecastEventCollector.py

+import aiohttp
+from http import HTTPStatus
+import asyncio
+from typing import Any


Missing imports cast and traceback.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/Integrations/MimecastEventCollector/MimecastEventCollector.py

+        self._proxy_url = handle_proxy().get("http", "") if proxy else None
+
+    async def __aenter__(self):
+        self._session = aiohttp.ClientSession(connector=aiohttp.TCPConnector(ssl=self._verify), proxy=self._proxy_url)


aiohttp.ClientSession does not accept a proxy argument.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/Integrations/MimecastEventCollector/MimecastEventCollector.py

-                raise DemistoException(f"There was an error with siem events call {fail_reason}")
+        while retry_count <= max_retries:
+            try:
+                async with self._session.request(method=method, url=url, headers=headers, **request_kwargs) as response:


Proxy configuration is missing in the request.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/Integrations/MimecastEventCollector/MimecastEventCollector.py

+                    demisto.debug(f"[{event_type}] Received HTTP 401 Unauthorized. Generating new token and retrying...")
+                    headers["Authorization"] = await self.get_authorization_header(force_generate_new_token=True)
+                    # Retry immediately with new token
+                    async with self._session.request(method=method, url=url, headers=headers, **request_kwargs) as response:


Proxy configuration is missing in the retry request.

content-bot · 2026-01-05T11:09:53Z

Packs/Mimecast/Integrations/MimecastEventCollector/README.md

+| Base URL | Use `https://api.services.mimecast.com` for the Global region or review the [Mimecast guide on per-region Base URLs](https://integrations.mimecast.com/documentation/api-overview/global-base-urls/) to find the suitable Base URL. | True |
+| Client ID | Refer to the help section for instructions on how to obtain API 2.0 OAuth2 credentials. | True |
+| Client secret | Refer to the help section for instructions on how to obtain API 2.0 OAuth2 credentials. | True |
+| Fetch events | | False |


Add a description for the "Fetch events" parameter.

content-bot · 2026-01-05T11:09:54Z

Packs/Mimecast/Integrations/MimecastEventCollector/README.md

 | **Argument Name** | **Description** | **Required** |
 | --- | --- | --- |
-| should_push_events | Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False. | Required |
+| should_push_events | If True, the command will push the events to the Cortex XSIAM dataset; otherwise, it will only display them. Default is False. | Required |


Clarify if this argument is Required or Optional.

content-bot · 2026-01-05T11:09:54Z

Packs/Mimecast/README.md

-Note: The supported time format is yyyy-MM-ddThh:mm:ss+|-nnnn (2021-12-08T10:00:00-0400). The relevant fields are "datetime" or "eventTime"
+# Mimecast
+
+Mimecast is a cloud-based email security and management platform that provides comprehensive protection against email-borne threats, data leaks, and ensures business continuity through email archiving and continuity services.


Grammar suggestion: Insert 'and' between 'email-borne threats' and 'data leaks' for better sentence structure.

content-bot · 2026-01-05T11:09:54Z

Packs/Mimecast/ReleaseNotes/3_0_0.md

+
+##### Mimecast Event Collector
+
+- **Breaking Changes**: Migrated from the legacy API 1.0 authentication method to OAuth2 client credentials flow for Mimecast API 2.0.


Consolidate all breaking changes under a single "Breaking Changes" bullet point for better readability and adherence to standards.

content-bot · 2026-01-05T11:09:54Z

Packs/Mimecast/ReleaseNotes/3_0_0.md

+
+- Added support for the ***Fetch event types*** parameter that denotes the types of audit and SIEM events to fetch.
+
+- Added support for the `siem_event_types`, `start_date`, and `end_date` arguments in the ***!mimecast-get-events*** command.


The argument name siem_event_types does not match the integration YAML. It should be event_types.

richardbluestone · 2026-01-05T11:14:50Z

Hi there! Thanks for the update to the Mimecast pack. I've reviewed the changes and have a few points to discuss, primarily regarding the proxy implementation and test mocking.

Please ensure proxy arguments are passed correctly to the request methods rather than the aiohttp session, and update the unit tests to use AsyncMock for asynchronous methods. It would also be helpful to clarify the API 2.0 credential steps in the documentation and consolidate the breaking changes in the release notes.

Great work so far

@richardbluestone, @JasBeilin please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

@julieschwartz18 Can you do this?

Add support for API 2.0 in Mimecast Event Collector

81f1aeb

kamalq97 self-assigned this Jan 1, 2026

Merge branch 'master' into CIAC-14914-mimecast-event-collector-v2

6e33356

kamalq97 requested a review from JasBeilin January 1, 2026 08:56

kamalq97 added enhancement inprogress It means the PR is still on progress, and should not be merged even if the build is green or approve python Pull requests that update Python code labels Jan 1, 2026

kamalq97 marked this pull request as draft January 1, 2026 08:57

kamalq97 added 3 commits January 4, 2026 12:07

Add logic to migrate from previous last run schema

4c87220

Fix SIEM events deduplication

4562185

Improve parameter names and docs

6c7da13

kamalq97 requested a review from richardbluestone January 5, 2026 10:02

kamalq97 added ready-for-pipeline-running Whether the pr is ready for running the whole pipeline, including testing on SAAS machines ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Jan 5, 2026

kamalq97 marked this pull request as ready for review January 5, 2026 10:03

Merge branch 'master' into CIAC-14914-mimecast-event-collector-v2

f587a36

content-bot removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jan 5, 2026

richardbluestone assigned julieschwartz18 Jan 5, 2026

richardbluestone removed their request for review January 5, 2026 11:07

content-bot reviewed Jan 5, 2026

View reviewed changes


		##### Mimecast Event Collector

		- Breaking Changes: Migrated from the legacy API 1.0 authentication method to OAuth2 client credentials flow for Mimecast API 2.0.


		- Added support for the *Fetch event types* parameter that denotes the types of audit and SIEM events to fetch.

		- Added support for the `siem_event_types`, `start_date`, and `end_date` arguments in the *!mimecast-get-events* command.

Add support for API 2.0 in Mimecast Event Collector #42498

Are you sure you want to change the base?

Add support for API 2.0 in Mimecast Event Collector #42498

Conversation

kamalq97 commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issues

Description

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Jan 5, 2026

Uh oh!

content-bot commented Jan 5, 2026

Uh oh!

content-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

richardbluestone commented Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kamalq97 commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading