Proofpoint Email Security Event Collector

Collects events for Proofpoint Email Security using the streaming API.

Analytics & SIEM · Proofpoint Email Security

Details

ID	`Proofpoint Email Security Event Collector`
Provider	Thoma Bravo
Category	Analytics & SIEM
From Version	6.9.0
Docker Image	`demisto/netutils:1.0.0.10187688`
Supported Modules	XSIAM

README

Collects events for Proofpoint using the streaming API.
This integration was integrated and tested Proofpoint Email Security.

Configure Proofpoint Email Security Event Collector in Cortex

Parameter	Description	Required
Server URL		True
Cluster ID	The user group ID.	True
API key		True
Use system proxy settings		False
Fetch Events		False
Event types to fetch	Denotes which event type to fetch, if not provided will fetch all kinds.	False
Fetch interval in seconds		True

Commands

proofpoint-es-get-last-run-results

Retrieves the results of a connection attempt to Proofpoint, indicating whether it was successful or failed and why. If event fetching has been initiated, this command provides the results of the most recent fetch attempt.

proofpoint-es-get-events

Retrieves events from the Proofpoint Email Security PoD archive for a specified time range to backfill gaps in fetched events. This command is intended for development and debugging purposes and is to be used with caution after consulting with engineering, as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism. Review the list of known limitations below for additional details.

Base Command

proofpoint-es-get-events

Input

Argument	Description	Required
since_time	The start of the time range to fetch events from. E.g., ‘3 days ago’, ‘2025-01-01T10:00:00’. Rounds down to the nearest hour.	Required
to_time	The end of the time range to fetch events from. E.g., ‘2 days ago’, ‘2025-01-01T11:00:00’. Rounds up to the nearest hour.	Required
timezone_offset	The UTC timezone offset in hours to apply to the since_time and to_time arguments. E.g. -5 for UTC-5.	Optional
event_types	A comma-separated list of event types to fetch. If not provided, all types will be retrieved.	Optional
limit	The maximum number of events to fetch per specified event type.	Optional
should_push_events	If true, the command will push the events to the Cortex XSIAM dataset; otherwise, it will only display them.	Optional

Context Output

There is no context output for this command.

Known Limitations

The API does not allow use of the same API Key for more than one session at the same time. To open more multiple simultaneous websocket connections to receive the same event type, additional API Key(s) must be generated via the Proofpoint PoD dashboard.
When running the proofpoint-es-get-events command, HTTP 409 (Conflict) errors may be raised if the integration instance has “Fetch Events” enabled. Ensure the “Fetch Events” checkbox is unchecked before triggering this command.
When running the proofpoint-es-get-events command, HTTP 400 (Bad Request) errors may be raised if the time range is older than 30 days. Ensure that both the since_time and to_time arguments are within the last 30 days.

Troubleshooting

In case of data ingestion delays or missing events, it is recommended to configure a separate integration instance per event type.

Configuration parameters

host — Server URL (required)
cluster_id — Cluster ID (required)
api_key — (required)
fetch_interval — Fetch interval in seconds (required)
longRunning — Long Running Instance
proxy — Use system proxy settings
event_types — Event types to fetch
isFetchEvents — Fetch events

Commands (2)

proofpoint-es-get-events
Retrieves events from the Proofpoint Email Security PoD archive for a specified time range to backfill gaps in fetched events. This command is intended for development and debugging purposes and is to be used with caution after consulting with engineering, as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.
proofpoint-es-get-last-run-results
Retrieves the results of a connection attempt to Proofpoint, indicating whether it was successful or failed and why. If event fetching has been initiated, this command provides the results of the most recent fetch attempt.

Source

ProofpointEmailSecurityEventCollector.py ProofpointEmailSecurityEventCollector_test.py ProofpointEmailSecurityEventCollector.yml ProofpointEmailSecurityEventCollector_description.md

Download History Raw

commonfields:
  id: Proofpoint Email Security Event Collector
  version: -1
name: Proofpoint Email Security Event Collector
display: Proofpoint Email Security Event Collector
category: Analytics & SIEM
provider: Thoma Bravo
description: Collects events for Proofpoint Email Security using the streaming API.
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL
  name: host
  type: 0
  defaultvalue: wss://logstream.proofpoint.com:443
  required: true
  section: Connect
- display: Cluster ID
  name: cluster_id
  type: 0
  required: true
  additionalinfo: The user group ID.
  section: Connect
- displaypassword: API key
  name: api_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Fetch interval in seconds
  name: fetch_interval
  type: 0
  defaultvalue: 60
  required: true
  section: Collect
- defaultvalue: 'true'
  display: Long Running Instance
  hidden: true
  name: longRunning
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Collect
- additionalinfo: Denotes which event type to fetch, if not provided will fetch all kinds.
  display: Event types to fetch
  name: event_types
  type: 16
  required: false
  options:
  - message
  - maillog
  - audit
  section: Collect
  advanced: true
  defaultvalue: message,maillog,audit
- display: Fetch events  # Checkbox should be visible on all supported products/modules to allow any user to disable event fetching before running the "!proofpoint-es-get-events" command
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: "true"
script:
  script: ""
  type: python
  commands:
  - name: "proofpoint-es-get-last-run-results"
    description: Retrieves the results of a connection attempt to Proofpoint, indicating whether it was successful or failed and why. If event fetching has been initiated, this command provides the results of the most recent fetch attempt.
  - name: "proofpoint-es-get-events"
    description: "Retrieves events from the Proofpoint Email Security PoD archive for a specified time range to backfill gaps in fetched events. This command is intended for development and debugging purposes and is to be used with caution after consulting with engineering, as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism."
    arguments:
    - name: "since_time"
      description: "The start of the time range to fetch events from. E.g., '3 days ago', '2025-01-01T10:00:00'. Rounds down to the nearest hour."
      required: true
    - name: "to_time"
      description: "The end of the time range to fetch events from. E.g., '2 days ago', '2025-01-01T11:00:00'. Rounds up to the nearest hour."
      required: true
    - name: "timezone_offset"
      description: "The UTC timezone offset in hours to apply to the since_time and to_time arguments. E.g. -5 for UTC-5."
      required: false
    - name: "event_types"
      description: "A comma-separated list of event types to fetch. If not provided, all types will be retrieved."
      required: false
      isArray: true
      auto: PREDEFINED
      predefined:
      - message
      - maillog
      - audit
    - name: "limit"
      description: "The maximum number of events to fetch per specified event type."
      required: false
      defaultValue: "10"
    - name: "should_push_events"
      description: If true, the command will push the events to the Cortex XSIAM dataset; otherwise, it will only display them. 
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
  dockerimage: demisto/netutils:1.0.0.10187688
  longRunning: true
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests
supportedModules:
- xsiam