Proofpoint Server Protection

Details

ID	`Proofpoint Server Protection`
Provider	Thoma Bravo
Category	Email
From Version	5.0.0
Docker Image	`demisto/bs4-py3:1.0.0.117152`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Overview

Use the Proofpoint Protection Server integration to manage your email security appliances.

This integration was integrated and tested with version 8.11.12 of Proofpoint Protection Server.

Users must be assigned to the podadmin role to use this integration.

This integration does not support SAML protocol for authentication.

Use Cases

Manage senders list.
Run operations on emails, such as release and download.
Manage quarantined messages and folder.

Configure Proofpoint Protection Server on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Proofpoint Protection Server.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g., https://192.168.0.1:10000)
- Username
- Password
- Proofpoint Protection Server Version (e.g., 8.14.2)
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-download-email
proofpoint-quarantine-messages
proofpoint-smart-search
proofpoint-quarantine-folders
proofpoint-release-email
proofpoint-add-to-blocked-senders-list
proofpoint-add-to-safe-senders-list
proofpoint-remove-from-blocked-senders-list
proofpoint-remove-from-safe-senders-list

1. proofpoint-download-email

Download email message by ID.

Base Command

proofpoint-download-email

Input

Argument Name	Description	Required
message_id	The GUID of the email message to download.	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-download-email message_id=37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com

2. proofpoint-quarantine-messages

Retrieves quarantined email messages.

Base Command

proofpoint-quarantine-messages

Input

Argument Name	Description	Required
folder	Folder name to quarantine.	Optional
sender	Messages from sender to quarantine.	Optional
subject	Messages subject to quarantine.	Optional
recipient	Messages to recipient to quarantine.	Optional

Context Output

Path	Type	Description
Proofpoint.Quarantine.Message.ID	String	Message ID
Proofpoint.Quarantine.Message.Date	Date	Message date
Proofpoint.Quarantine.Message.Recipient	String	Message recipient
Proofpoint.Quarantine.Message.Sender	String	Message sender
Proofpoint.Quarantine.Message.Subject	String	Message subject
Proofpoint.Quarantine.Message.Folder	String	Message folder

Command Example

!proofpoint-quarantine-messages recipient=user1@demisto.com

Context Example

{
    "Proofpoint.Quarantine.Message": {
        "ID": "37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com",
        "Date": "2020-01-25 11:30:00",
        "Recipient": "user1@demisto.com",
        "Sender": "bwillis@email.com",
        "Subject": "[External] Welcome !"
        "Folder": "Inbox
    }
}

Human Readable Output

Proofpoint Protection Server Quarantine Search Messages Results

ID	Date	Recipient	Sender	Subject	Folder
37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com	2020-01-25 11:30:00	user1@demisto.com	bwillis@email.com	External Welcome !	Inbox

3. proofpoint-smart-search

Searches for emails.

Base Command

proofpoint-smart-search

Input

Argument Name	Description	Required
process	Max results	Optional
sender	Email sender.	Optional
subject	Email subject.	Optional
recipient	Email recipient.	Optional
sender_hostname	Sender hostname/IP address	Optional
attachment	Attachment name	Optional
qid	QID	Optional
time	Time period in which the email was recieved.	Optional
message_id	Email message ID.	Optional
virus_name	Virus name.	Optional
sid	SID	Optional
guid	GUID	Optional

Context Output

Path	Type	Description
Proofpoint.SmartSearch.SMIMERecipients	String	Search results SMIME recipients
Proofpoint.SmartSearch.FID	String	Search results FID
Proofpoint.SmartSearch.MessageID	String	Search results email message ID
Proofpoint.SmartSearch.Suborg	String	Search results sub organization
Proofpoint.SmartSearch.Agent	String	Search results email agent
Proofpoint.SmartSearch.AttachmentNames	String	Search results email attachment names
Proofpoint.SmartSearch.MoudleID	String	Search results module ID
Proofpoint.SmartSearch.MessageSize	String	Search results email message size
Proofpoint.SmartSearch.SpamScore	String	Search results email spam score
Proofpoint.SmartSearch.GUID	String	Search results GUID
Proofpoint.SmartSearch.Recipients	String	Search results send mail to
Proofpoint.SmartSearch.Date	String	Search results date
Proofpoint.SmartSearch.Sender	String	Search results email sender
Proofpoint.SmartSearch.Subject	String	Search results email subject

Command Example

!proofpoint-smart-search recipient=user1@demisto.com process=100 time=Last24Hours

Context Example

{
    "Proofpoint.SmartSearch": {
        "Date": "2020-01-25 11:30:00",
        "Recipients": "user1@demisto.com",
        "Sender": "bwillis@email.com",
        "Subject": "[External] Welcome !",
        "MessageSize": "20750"
    }
}

Human Readable Output

Proofpoint Protection Server Smart Search Results

ID	Date	Recipient	Sender	Subject	MessageSize
37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com	2020-01-25 11:30:00	user1@demisto.com	bwillis@email.com	External Welcome !	20750

4. proofpoint-quarantine-folders

Returns a list of quarantined folders.

Base Command

proofpoint-quarantine-folders

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
Proofpoint.Quarantine.Folder.Name	String	Folder name

Command Example


##### Context Example

{
“Proofpoint.Quarantine.Folder”: [
{
“Name”: “Adult”,
“Name”: “Audit”,
“Name”: “Blocked”,
“Name”: “Malware”
}
]
}
```

Human Readable Output

Proofpoint Protection Server Quarantine Folders

Name
Adult
Audit
Blocked
Malware

5. proofpoint-release-email

Release email with virus scan

Base Command

proofpoint-download-email

Input

Argument Name	Description	Required
message_id	Email message ID to release.	Required
folder	Email folder to release.	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-download-email message_id=37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com folder=Blocked

Human Readable Output

Released message 37b6d02m-63e0-495e-kk92-7c21511adc7a@SB2APC01FT091.outlook.com successfully

6. proofpoint-add-to-blocked-senders-list

Adds an email address to blocked senders list.

Base Command

proofpoint-add-to-blocked-senders-list

Input

Argument Name	Description	Required
email	Email to add to blocked senders list	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-add-to-blocked-senders-list email=bwillis@email.com

Human Readable Output

Successfully added bwillis@email.com to the Blocked Senders list

7. proofpoint-add-to-safe-senders-list

Adds an email address to safe senders list.

Base Command

proofpoint-add-to-safe-senders-list

Input

Argument Name	Description	Required
email	Email to add to safe senders list	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-add-to-safe-senders-list email=bwillis@email.com

Human Readable Output

Successfully added bwillis@email.com to the Safe Senders list

8. proofpoint-remove-from-blocked-senders-list

Removes an email address from blocked senders list.

Base Command

proofpoint-remove-from-blocked-senders-list

Input

Argument Name	Description	Required
email	Email to remove from blocked senders list	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-remove-from-blocked-senders-list email=bwillis@email.com

Human Readable Output

Successfully removed bwillis@email.com from the Blocked Senders list

8. proofpoint-remove-from-safe-senders-list

Removes an email address from safe senders list.

Base Command

proofpoint-remove-from-safe-senders-list

Input

Argument Name	Description	Required
email	Email to remove from safe senders list	Required

Context Output

There is no context output for this command.

Command Example

!proofpoint-remove-from-safe-senders-list email=bwillis@email.com

Human Readable Output

Successfully removed bwillis@email.com from the Safe Senders list

Configuration parameters

server — Server URL (e.g., https://192.168.0.1:10000) (required)
credentials — Username (required)
version — Proofpoint Protection Server Version (e.g., 8.14.2)
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (9)

proofpoint-add-to-blocked-senders-list
Adds an email address to blocked senders list.
proofpoint-add-to-safe-senders-list
Adds an email address to safe senders list.
proofpoint-download-email
Download quarantine email message by ID.
proofpoint-quarantine-folders
Returns a list of quarantined folders.
proofpoint-quarantine-messages
Retrieves quarantined email messages.
proofpoint-release-email
Release email with virus scan.
proofpoint-remove-from-blocked-senders-list
Removes an email address from blocked senders list.
proofpoint-remove-from-safe-senders-list
Removes an email address from safe senders list.
proofpoint-smart-search
Searches for emails.

Source

ProofpointServerProtection.py ProofpointServerProtection.yml ProofpointServerProtection_description.md

Download History Raw

commonfields:
  id: Proofpoint Server Protection
  version: -1
name: Proofpoint Server Protection
display: Proofpoint Protection Server (Deprecated)
deprecated: true
category: Email
provider: Thoma Bravo
description: Deprecated. Use Proofpoint Protection Server V2 instead.
configuration:
- display: Server URL (e.g., https://192.168.0.1:10000)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Proofpoint Protection Server Version (e.g., 8.14.2)
  name: version
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: proofpoint-download-email
    arguments:
    - name: message_id
      required: true
      default: true
      description: The GUID of the email message to download.
    description: Download quarantine email message by ID.
  - name: proofpoint-quarantine-messages
    arguments:
    - name: folder
      description: Folder name to quarantine.
    - name: sender
      description: Messages from sender to quarantine.
    - name: subject
      description: Messages subject to quarantine.
    - name: recipient
      description: Messages to recipient to quarantine.
    outputs:
    - contextPath: Proofpoint.Quarantine.Message.ID
      description: Message ID.
      type: string
    - contextPath: Proofpoint.Quarantine.Message.Date
      description: Message date.
      type: date
    - contextPath: Proofpoint.Quarantine.Message.Recipient
      description: Message recipient.
      type: string
    - contextPath: Proofpoint.Quarantine.Message.Sender
      description: Message sender.
      type: string
    - contextPath: Proofpoint.Quarantine.Message.Subject
      description: Message subject.
      type: string
    - contextPath: Proofpoint.Quarantine.Message.Folder
      description: Message folder.
      type: string
    description: Retrieves quarantined email messages.
  - name: proofpoint-smart-search
    arguments:
    - name: sender
      description: Email sender.
    - name: recipient
      description: Email recipient.
    - name: subject
      description: Email subject.
    - name: process
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      - "100"
      - "200"
      - "500"
      - "1000"
      description: Max results.
      defaultValue: "100"
    - name: sender_hostname
      description: Sender hostname/IP address.
    - name: attachment
      description: Attachment name.
    - name: qid
      description: QID.
    - name: time
      auto: PREDEFINED
      predefined:
      - Last15Minutes
      - Last60Minutes
      - Last3Hours
      - Last24Hours
      - Last7Days
      - Last15Days
      - Last30Days
      - Last90Days
      description: Time period in which the email was recieved.
      defaultValue: Last24Hours
    - name: message_id
      description: Email message ID.
    - name: virus_name
      description: Virus name.
    - name: sid
      description: SID.
    - name: guid
      description: GUID.
    outputs:
    - contextPath: Proofpoint.SmartSearch.SMIMERecipients
      type: string
      description: Search results SMIME recipients.
    - contextPath: Proofpoint.SmartSearch.FID
      type: string
      description: Search results FID.
    - contextPath: Proofpoint.SmartSearch.MessageID
      type: string
      description: Search results email message ID.
    - contextPath: Proofpoint.SmartSearch.Suborg
      type: string
      description: Search results sub organization.
    - contextPath: Proofpoint.SmartSearch.Agent
      type: string
      description: Search results email agent.
    - contextPath: Proofpoint.SmartSearch.AttachmentNames
      type: string
      description: Search results email attachment names.
    - contextPath: Proofpoint.SmartSearch.MoudleID
      type: string
      description: Search results module ID.
    - contextPath: Proofpoint.SmartSearch.MessageSize
      type: string
      description: Search results email message size.
    - contextPath: Proofpoint.SmartSearch.SpamScore
      type: string
      description: Search results email spam score.
    - contextPath: Proofpoint.SmartSearch.GUID
      type: string
      description: Search results GUID.
    - contextPath: Proofpoint.SmartSearch.QuarantineRule
      type: string
      description: Search results email message quarantine rule.
    - contextPath: Proofpoint.SmartSearch.VirusNames
      type: string
      description: Search results virus names.
    - contextPath: Proofpoint.SmartSearch.Subject
      type: string
      description: Search results email subject.
    - contextPath: Proofpoint.SmartSearch.QID
      type: string
      description: Search results QID.
    - contextPath: Proofpoint.SmartSearch.FinalAction
      type: string
      description: Search results email final action.
    - contextPath: Proofpoint.SmartSearch.DispositionAction
      type: string
      description: Search results email disposition action.
    - contextPath: Proofpoint.SmartSearch.SID
      type: string
      description: Search results SID.
    - contextPath: Proofpoint.SmartSearch.SendmailToStat
      type: string
      description: Search results sent email to stats.
    - contextPath: Proofpoint.SmartSearch.Date
      type: date
      description: Search results date.
    - contextPath: Proofpoint.SmartSearch.PERecipients
      type: string
      description: Search results email PE recipients.
    - contextPath: Proofpoint.SmartSearch.FQIN
      type: string
      description: Search results email FQIN.
    - contextPath: Proofpoint.SmartSearch.FinalRule
      type: string
      description: Search results email final rule.
    - contextPath: Proofpoint.SmartSearch.SendmailStat
      type: string
      description: Search results email stats.
    - contextPath: Proofpoint.SmartSearch.MessageSplit
      type: string
      description: Search results email split message.
    - contextPath: Proofpoint.SmartSearch.Duration
      type: string
      description: Search results duration time.
    - contextPath: Proofpoint.SmartSearch.SendmailAction
      type: string
      description: Search results sent mail action.
    - contextPath: Proofpoint.SmartSearch.Sender
      type: string
      description: Search results email sender.
    - contextPath: Proofpoint.SmartSearch.SendmailIPAddress
      type: string
      description: Search results send mail IP address.
    - contextPath: Proofpoint.SmartSearch.SendmailTo
      type: string
      description: Search results send mail to.
    - contextPath: Proofpoint.SmartSearch.Recipients
      type: string
      description: Search results recipients.
    - contextPath: Proofpoint.SmartSearch.SendmailRawLog
      type: string
      description: Search results send mail raw log.
    - contextPath: Proofpoint.SmartSearch.TLS
      type: string
      description: Search results TLS.
    - contextPath: Proofpoint.SmartSearch.QuarantineFolder
      type: string
      description: Search results quarantine folder.
    - contextPath: Proofpoint.SmartSearch.RawLog
      type: string
      description: Search results raw log.
    - contextPath: Proofpoint.SmartSearch.DispositionSmtpProfile
      type: string
      description: Search results disposition SMTP profile.
    - contextPath: Proofpoint.SmartSearch.PolicyRoutes
      type: string
      description: Search results policy routes.
    - contextPath: Proofpoint.SmartSearch.MessageEncrypted
      type: string
      description: Search results encrypted message.
    - contextPath: Proofpoint.SmartSearch.SenderHost
      type: string
      description: Search results sender host.
    - contextPath: Proofpoint.SmartSearch.SMIMRecipientsSigned
      type: string
      description: Search results SMIME recipient signed.
    description: Searches for emails.
  - name: proofpoint-quarantine-folders
    arguments: []
    outputs:
    - contextPath: Proofpoint.Quarantine.Folder.Name
      description: Folder name.
      type: string
    description: Returns a list of quarantined folders.
  - name: proofpoint-release-email
    arguments:
    - name: message_id
      required: true
      description: Email message ID to release.
    - name: folder
      required: true
      description: Email folder to release.
    description: Release email with virus scan.
  - name: proofpoint-add-to-blocked-senders-list
    arguments:
    - name: email
      required: true
      description: Email to add to blocked senders list.
    description: Adds an email address to blocked senders list.
  - name: proofpoint-add-to-safe-senders-list
    arguments:
    - name: email
      required: true
      description: Email to add to safe senders list.
    description: Adds an email address to safe senders list.
  - name: proofpoint-remove-from-blocked-senders-list
    arguments:
    - name: email
      required: true
      description: Email to remove from blocked senders list.
    description: Removes an email address from blocked senders list.
  - name: proofpoint-remove-from-safe-senders-list
    arguments:
    - name: email
      required: true
      description: Email to remove from safe senders list.
    description: Removes an email address from safe senders list.
  dockerimage: demisto/bs4-py3:1.0.0.117152
  subtype: python3
tests:
- no test
fromversion: 5.0.0

Proofpoint Server Protection Deprecated

Details

README

Overview

Use Cases

Configure Proofpoint Protection Server on Cortex XSOAR

Commands

1. proofpoint-download-email

Base Command

Input

Context Output

Command Example

2. proofpoint-quarantine-messages

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Proofpoint Protection Server Quarantine Search Messages Results

3. proofpoint-smart-search

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Proofpoint Protection Server Smart Search Results

4. proofpoint-quarantine-folders

Base Command

Input

Context Output

Command Example

Human Readable Output

Proofpoint Protection Server Quarantine Folders

5. proofpoint-release-email

Base Command

Input

Context Output

Command Example

Human Readable Output

6. proofpoint-add-to-blocked-senders-list

Base Command

Input

Context Output

Command Example

Human Readable Output

7. proofpoint-add-to-safe-senders-list

Base Command

Input

Context Output

Command Example

Human Readable Output

8. proofpoint-remove-from-blocked-senders-list

Base Command

Input

Context Output

Command Example

Human Readable Output

8. proofpoint-remove-from-safe-senders-list

Base Command

Input

Context Output

Command Example

Human Readable Output

Configuration parameters

Commands (9)

Source