feat: Mimecast email integration — message logs, threat events, 120d retention, admin UI

migrations/055_create_mimecast_tables.sql

@@ -0,0 +1,72 @@
+-- ============================================================================
+-- Mimecast Email Integration Tables
+-- 120-day rolling retention for message logs, threat events, and message bodies
+-- ============================================================================
+
+-- Core message tracking log
+CREATE TABLE IF NOT EXISTS mimecast_messages (
+    id                  TEXT PRIMARY KEY,
+    sender_address      TEXT,
+    sender_domain       TEXT,
+    recipient_address   TEXT,
+    subject             TEXT,
+    direction           TEXT,           -- 'inbound' | 'outbound'
+    status              TEXT,           -- 'delivered' | 'rejected' | 'bounced' | 'held' | 'spam'
+    action              TEXT,
+    spam_score          NUMERIC,
+    size_bytes          BIGINT,
+    attachment_count    INT DEFAULT 0,
+    sent_datetime       TIMESTAMPTZ,
+    received_datetime   TIMESTAMPTZ,
+    delivery_datetime   TIMESTAMPTZ,
+    route               TEXT,
+    reject_reason       TEXT,
+    held_reason         TEXT,
+    source_ip           TEXT,
+    raw                 JSONB,          -- Full API response for forward-compat
+    synced_at           TIMESTAMPTZ DEFAULT NOW(),
+    created_at          TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Separate table for message bodies (large, for LLM use only)
+CREATE TABLE IF NOT EXISTS mimecast_message_bodies (
+    message_id  TEXT PRIMARY KEY REFERENCES mimecast_messages(id) ON DELETE CASCADE,
+    body_text   TEXT,
+    body_html   TEXT,
+    headers     JSONB,
+    fetched_at  TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- SIEM/threat events
+CREATE TABLE IF NOT EXISTS mimecast_threat_events (
+    id              TEXT PRIMARY KEY,
+    message_id      TEXT REFERENCES mimecast_messages(id) ON DELETE SET NULL,
+    event_type      TEXT,   -- 'url_click' | 'attachment_sandbox' | 'impersonation' | 'spam' | 'virus'
+    threat_level    TEXT,   -- 'high' | 'medium' | 'low' | 'info'
+    url             TEXT,
+    file_name       TEXT,
+    verdict         TEXT,
+    actor_email     TEXT,
+    event_datetime  TIMESTAMPTZ,
+    details         JSONB,  -- Full raw event payload
+    synced_at       TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Cursor-based pagination state for resumable syncs
+CREATE TABLE IF NOT EXISTS mimecast_sync_state (
+    sync_type       TEXT PRIMARY KEY,  -- 'messages' | 'threats' | 'held'
+    last_synced_at  TIMESTAMPTZ,
+    cursor          TEXT,
+    updated_at      TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_mimecast_messages_sent_datetime    ON mimecast_messages (sent_datetime DESC);
+CREATE INDEX IF NOT EXISTS idx_mimecast_messages_sender_domain    ON mimecast_messages (sender_domain);
+CREATE INDEX IF NOT EXISTS idx_mimecast_messages_status           ON mimecast_messages (status);
+CREATE INDEX IF NOT EXISTS idx_mimecast_messages_direction        ON mimecast_messages (direction);
+CREATE INDEX IF NOT EXISTS idx_mimecast_messages_recipient        ON mimecast_messages (recipient_address);
+CREATE INDEX IF NOT EXISTS idx_mimecast_threat_events_datetime    ON mimecast_threat_events (event_datetime DESC);
+CREATE INDEX IF NOT EXISTS idx_mimecast_threat_events_type        ON mimecast_threat_events (event_type);
+CREATE INDEX IF NOT EXISTS idx_mimecast_threat_events_level       ON mimecast_threat_events (threat_level);
+CREATE INDEX IF NOT EXISTS idx_mimecast_threat_events_details     ON mimecast_threat_events USING GIN (details);