ProofpointIsolationEventCollector

Details

ID	`ProofpointIsolationEventCollector`
Provider	Thoma Bravo
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	XSIAM

README

Proofpoint Isolation is an integration that supports fetching Browser and Email Isolation logs events within Cortex XSIAM.
This integration was integrated and tested with version V2 of ProofpointIsolation.

Configure Proofpoint Isolation in Cortex

Parameter	Description	Required
Server URL	The endpoint URL.	True
API Key	The API Key to use for connection	True
Maximum number of events per fetch	Defines The maximum number of browser and email isolation events per fetch cycle. Default value: 50000.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

How to Access Reporting API

In Proofpoint Isolation, navigate to Product Settings > Reporting API. Proofpoint Isolation’s Reporting API tools and documentation display in the Console’s main viewing panel.
Copy the reporting API key.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-isolation-get-events

Retrieves a list of events from the Proofpoint Isolation instance.

Base Command

proofpoint-isolation-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of events to return. Value range: 1-50000.	Required
start_date	From which date to fetch the events.	Required
end_date	Until which date to fetch the events.	Required

Context Output

Path	Type	Description
ProofpointIsolationEventCollector	List	The list of events.

Command example

!proofpoint-isolation-get-events should_push_events=false limit=10 end_date=2025-01-12 start_date=2025-01-11T11:27:08

Configuration parameters

base_url — Server URL (required)
credentials — (required)
max_events_per_fetch — Maximum number of events per fetch (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

proofpoint-isolation-get-events
Retrieves a list of events from the Proofpoint Isolation instance.

Source

ProofpointIsolationEventCollector.py ProofpointIsolationEventCollector_test.py ProofpointIsolationEventCollector.yml ProofpointIsolationEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: ProofpointIsolationEventCollector
  version: -1
configuration:
- defaultvalue: https://proofpointisolation.com
  additionalinfo: The endpoint URL.
  display: Server URL
  name: base_url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  additionalinfo: The API Key to use for connection.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- additionalinfo: 'Defines the maximum number of browser and email isolation events per fetch cycle. Default value: 50000.'
  defaultvalue: "50000"
  display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: true
  type: 0
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: 'Proofpoint Isolation is an integration that supports fetching Browser and Email Isolation logs events.'
display: Proofpoint Isolation
name: ProofpointIsolationEventCollector
script:
  commands:
  - name: proofpoint-isolation-get-events
    description: Retrieves a list of events from the Proofpoint Isolation instance.
    arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise it will only display them.
      name: should_push_events
      predefined:
        - 'true'
        - 'false'
      required: true
    - description: 'Maximum number of events to return. Value range: 1-50000.'
      name: limit
      required: true
    - description: 'The starting date from which events should be fetched. The date should be in the format "YYYY-MM-DDTHH:MM:SS". Example: 2025-01-01T11:27:08.'
      name: start_date
      required: true
    - description: 'The date up to which events should be fetched. The date should be in the format "YYYY-MM-DDTHH:MM:SS". Example: 2025-01-01T11:27:08.'
      name: end_date
      required: true
    outputs:
      - contextPath: ProofpointIsolationEventCollector
        description: The list of events.
        type: List
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam