What is the best way to ingest links from the body of emails O365 Exchange or Mimecast?

[benwebsternucle]

I am currently ingesting O365 Exchange and Mimecast logs in to Splunk, but I would like to start ingesting any links that are contained in the body of emails to allow additional security checks. Has anyone come across a good way to achieve this?

Thanks

[nickhills · Accepted solution]

I have done this in the past with MimeCast - I don't think the MimeCast TA supported this, so I wrote a script to pull the message content in from the API.

https://www.mimecast.com/tech-connect/documentation/endpoint-reference/archive/get-message-detail/