Proofpoint Cloud Threat Response

Fetches Proofpoint Cloud Threat Response (CTR) incidents into Cortex XSOAR for case management, and exposes commands to list and retrieve incident details.

Case Management · Proofpoint Cloud Threat Response

Configuration parameters

  • url — Server URL (required)
  • credentials — Client ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Maximum number of incidents per fetch
  • fetch_delta — Fetch delta (minutes)
  • fetch_states — Fetch incidents with specific states
  • fetch_enrich — Enrich incidents during fetch

Commands (2)

  • proofpoint-ctr-incident-get

    Returns full details for a specific Proofpoint Cloud Threat Response incident.

  • proofpoint-ctr-incidents-list

    Returns a list of Proofpoint Cloud Threat Response incidents matching the supplied filters.