@Graylog@infosec.exchange Good point about siloed telemetry. One thing worth adding: DMARC aggregate reports are another underused source of email threat visibility, showing exactly which IPs are sending on your domain's behalf, legitimate or otherwise. Feeding that into a SIEM alongside Mimecast logs gives a much fuller picture of impersonation attempts before they even reach the inbox.