Forcepoint DLP Event Collector

Use this integration to fetch security incidents from Forcepoint DLP as Cortex XSIAM events.

Email · Forcepoint DLP

Details

IDForcepoint DLP Event Collector
ProviderFrancisco Partners
CategoryEmail
From Version8.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

Use this integration to fetch security incidents from Forcepoint DLP as Cortex XSIAM events.

Configure Forcepoint DLP Event Collector in Cortex

Parameter Required
Server URL True
API Key True
Maximum number of events per fetch False
First fetch False
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

forcepoint-dlp-get-events

Gets events from Forcepoint DLP.

Base Command

forcepoint-dlp-get-events

Input

Argument Name Description Default Required
limit The number of events to return. 10 Optional
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. false Required

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (e.g., https://<DLP Manager IP>:<DLP Manager port>/) (required)
  • credentials — Username (required)
  • max_fetch — Maximum number of events per fetch
  • first_fetch — First fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • forcepoint-dlp-get-events

    Gets security events from Forcepoint DLP.

Source

ForcepointEventCollector.py ForcepointEventCollector_test.py ForcepointEventCollector.yml ForcepointEventCollector_description.md command_examples.txt
Download History Raw 
!forcepoint-dlp-get-events limit=1