Proofpoint Cloud Threat Response

Fetches Proofpoint Cloud Threat Response (CTR) incidents into Cortex XSOAR for case management, and exposes commands to list and retrieve incident details.
This integration was integrated and tested with version 1.0 of Proofpoint Cloud Threat Response.

Configure Proofpoint Cloud Threat Response in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-ctr-incidents-list

Returns a list of Proofpoint Cloud Threat Response incidents matching the supplied filters.

Base Command

proofpoint-ctr-incidents-list

Input

Context Output

Command Example

!proofpoint-ctr-incidents-list limit=2

Context Example

[
    {
        "id": "00000000-0000-0000-0000-000000000001",
        "createdAt": "2024-01-01T10:00:00.000+00:00",
        "updatedAt": "2024-01-01T10:05:00.000+00:00",
        "displayId": 12345,
        "priority": "high",
        "title": "user[@]example[.]com reported a message \"Suspicious phishing attempt\"",
        "state": "open",
        "assignedTeamName": "SOC_Analyst",
        "messageCount": 1,
        "sourceTypes": ["abuse_mailbox"],
        "sourcesData": [{"type": "AbuseMailbox", "name": "Proofpoint CLEAR"}],
        "dispositions": ["manual_review"],
        "clearVerdicts": ["manual_review"],
        "clearConfidences": ["low"]
    },
    {
        "id": "00000000-0000-0000-0000-000000000002",
        "createdAt": "2024-01-01T09:00:00.000+00:00",
        "updatedAt": "2024-01-01T09:30:00.000+00:00",
        "closedAt": "2024-01-01T09:30:00.000+00:00",
        "displayId": 12344,
        "priority": null,
        "title": "other[@]example[.]com reported a message \"Low risk email review\"",
        "state": "closed",
        "assignedTeamName": "SOC_Analyst",
        "messageCount": 18,
        "sourceTypes": ["abuse_mailbox"],
        "sourcesData": [{"type": "AbuseMailbox", "name": "Proofpoint CLEAR"}],
        "dispositions": ["low_risk"],
        "clearVerdicts": ["low_risk"],
        "clearConfidences": ["high"]
    }
]

Human Readable Output

Proofpoint Cloud Threat Response Incidents

ID	Created At	Type	State	Message Count	Assigned Team Name	Title	Source Types
00000000-0000-0000-0000-000000000001	2024-01-01T10:00:00.000+00:00	AbuseMailbox	open	1	SOC_Analyst	user[@]example[.]com reported a message “Suspicious phishing attempt”	abuse_mailbox
00000000-0000-0000-0000-000000000002	2024-01-01T09:00:00.000+00:00	AbuseMailbox	closed	18	SOC_Analyst	other[@]example[.]com reported a message “Low risk email review”	abuse_mailbox

proofpoint-ctr-incident-get

Returns full details for a specific Proofpoint Cloud Threat Response incident.

Base Command

proofpoint-ctr-incident-get

Input

Context Output

Command Example

!proofpoint-ctr-incident-get incident_id=00000000-0000-0000-0000-000000000001

Context Example

{
    "id": "00000000-0000-0000-0000-000000000001",
    "createdAt": "2024-01-01T10:00:00.000+00:00",
    "updatedAt": "2024-01-01T10:05:00.000+00:00",
    "displayId": 12345,
    "priority": "high",
    "state": "open",
    "title": "user[@]example[.]com reported a message \"Suspicious phishing attempt\"",
    "closedAt": null,
    "openedAt": "2024-01-01T10:00:00.000+00:00",
    "assignedTeamName": "SOC_Analyst",
    "assignedApplicationUserName": null,
    "messageCount": 1,
    "messageSourceData": {
        "hasTapAlert": false,
        "hasAbuseAlert": true,
        "hasSmartSearchImport": false,
        "hasMessageCsvUpload": false,
        "hasWorkbenchEvent": false,
        "hasImdAlert": false,
        "hasMailBombAlert": false
    },
    "comments": [],
    "activities": [
        {
            "id": "00000000-0000-0000-0000-000000000006",
            "cause_type": "system",
            "created_at": "2024-01-01T10:00:00.000",
            "occurred_at": "2024-01-01T10:00:00.000000",
            "activity_type": "incident_creation",
            "activity_details": {
                "source_name": "Proofpoint CLEAR",
                "initial_priority": null,
                "initial_team_name": "SOC_Analyst"
            },
            "causing_user_name": null,
            "causing_workflow_name": null
        },
        {
            "id": "00000000-0000-0000-0000-000000000008",
            "cause_type": "history",
            "created_at": "2024-01-01T10:00:10.000",
            "activity_type": "quarantine",
            "activity_details": {
                "quarantine_attempts": [
                    {
                        "state": "complete",
                        "disposition": "message_moved"
                    }
                ]
            },
            "causing_workflow_name": "Official Manual Review"
        }
    ]
}

Human Readable Output

Proofpoint Cloud Threat Response Incident: 12345

ID	Created At	State	Message Count	Assigned Team Name	Title
00000000-0000-0000-0000-000000000001	2024-01-01T10:00:00.000+00:00	open	1	SOC_Analyst	user[@]example[.]com reported a message “Suspicious phishing attempt”

Known Limitations

Fetch Enrichment and API Rate Limits

By default, the “Enrich incidents during fetch” parameter is disabled. When disabled, each fetch cycle makes a single API call to retrieve the incident list, and the raw JSON stored per incident contains only the fields returned by the list endpoint (summary fields such as id, title, state, createdAt, messageCount, etc.).

When enrichment is enabled, the integration makes one additional GET /api/v1/tric/incidents/{id} call per incident in every fetch cycle. This provides richer data immediately (activities, comments, messageSourceData) but multiplies API call volume proportionally to the number of incidents fetched. In environments with high incident volume this can trigger Proofpoint API rate limits (HTTP 429).

Recommended approach for high-volume environments:

1. Keep “Enrich incidents during fetch” disabled (default).
2. Use the proofpoint-ctr-incident-get command to enrich individual incidents on demand from a playbook or manually from the War Room.
3. Because both commands write to the same context key (ProofPointCloud.Incident.id), running proofpoint-ctr-incident-get after proofpoint-ctr-incidents-list will enrich the existing context entry rather than creating a duplicate.