Proofpoint Threat Protection

Details

ID	`Proofpoint Threat Protection`
Provider	Thoma Bravo
Category	Email
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Threat Protection APIs are REST APIs that allow Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

Configure Proofpoint Threat Protection in Cortex

Parameter	Required
URL	True
Client ID	True
Client Secret	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Cluster ID	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-tp-blocklist-get

Get all entries in the Organizational Block List.

Base Command

proofpoint-tp-blocklist-get

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
ProofpointThreatProtection.Blocklist	unknown	A list of entries in the blocklist.

proofpoint-tp-blocklist-add-or-delete-entry

Add/Delete entry from the Organizational Block List.

Base Command

proofpoint-tp-blocklist-add-or-delete-entry

Input

Argument Name	Description	Required
action	The action to perform. Possible values are: add, delete.	Required
attribute	Supported attributes for the Organizational Block List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Block List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry that the action is to be performed upon in the Organizational Block List.	Required
comment	A short comment about the entry (max 150 chars). “comment” is ignored for the “delete” action.	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Blocklist	unknown	Standard HTTP response with status code 200.

proofpoint-tp-safelist-get

Get all entries in the Organizational Safe List.

Base Command

proofpoint-tp-safelist-get

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
ProofpointThreatProtection.Safelist	unknown	A list of entries in the Organizational Safe List.

proofpoint-tp-safelist-add-or-delete-entry

Add To/Delete From the Organizational Safe List.

Base Command

proofpoint-tp-safelist-add-or-delete-entry

Input

Argument Name	Description	Required
action	The action to perform. Possible values are: add, delete.	Required
attribute	Supported attributes for the Organizational Safe List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Safe List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry that the action is to be performed upon in the Organizational Safe List.	Required
comment	A short comment about the entry (max 150 chars). “comment” is optional for “add” action and ignored for the “delete” action.	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Safelist	unknown	Standard HTTP response with status code 200.

proofpoint-tp-blocklist-list

Get entries from the Organizational Block List.

Base Command

proofpoint-tp-blocklist-list

Input

Argument Name	Description	Required
all_results	A boolean argument to designate whether to send back all the list results. This argument takes precedence over the limit argument when set to true. Default is False. Possible values are: True, False.	Optional
limit	An integar argument to designate the amount of entries to return from the list results. Defualt is 25. Maximum is 100.	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Blocklist	unknown	A list of entries in the blocklist.

proofpoint-tp-blocklist-add-entry

Add an entry to the Organizational Block List.

Base Command

proofpoint-tp-blocklist-add-entry

Input

Argument Name	Description	Required
attribute	Supported attributes for the Organizational Block List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Block List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry that is to be added to the Organizational Block List.	Required
comment	An optional short comment about the added entry (max 150 chars).	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Blocklist	unknown	Standard HTTP response with status code 200.

proofpoint-tp-blocklist-delete-entry

Delete an entry from the Organizational Block List.

Base Command

proofpoint-tp-blocklist-delete-entry

Input

Argument Name	Description	Required
attribute	Supported attributes for the Organizational Block List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Block List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry that is to be deleted from the Organizational Block List.	Required
comment	The short comment associated with the blockilst entry.	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Blocklist	unknown	Standard HTTP response with status code 200.

proofpoint-tp-safelist-list

Get entries from the Organizational Safe List.

Base Command

proofpoint-tp-safelist-list

Input

Argument Name	Description	Required
all_results	A boolean argument to designate whether to send back all the list results. This argument takes precedence over the limit argument when set to true. Default is False. Possible values are: True, False.	Optional
limit	An integar argument to designate the amount of entries to return from the list results. Defualt is 25. Maximum is 100.	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Safelist	unknown	A list of entries in the Organizational Safe List.

proofpoint-tp-safelist-add-entry

Add an entry to the Organizational Safe List.

Base Command

proofpoint-tp-safelist-add-entry

Input

Argument Name	Description	Required
attribute	Supported attributes for the Organizational Safe List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Safe List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry to be added to the Organizational Safe List.	Required
comment	An optional short comment about the added entry (max 150 chars).	Optional

Context Output

Path	Type	Description
ProofpointThreatProtection.Safelist	unknown	Standard HTTP response with status code 200.

proofpoint-tp-safelist-delete-entry

Delete an entry from the Organizational Safe List.

Base Command

proofpoint-tp-safelist-delete-entry

Input

Argument Name	Description	Required
attribute	Supported attributes for the Organizational Safe List. Possible values are: $from, $hfrom, $ip, $host, $helo, $rcpt.	Required
operator	Supported operators for the Organizational Safe List. Possible values are: equal, not_equal, contain, not_contain.	Required
value	The entry to be deleted from the Organizational Safe List.	Required

Context Output

Path	Type	Description
ProofpointThreatProtection.Safelist	unknown	Standard HTTP response with status code 200.

Configuration parameters

url — Server URL (required)
credentials — Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
cluster_id — Cluster ID (required)

Commands (6)

proofpoint-tp-blocklist-add-entry
Add an entry to the Organizational Block List.
proofpoint-tp-blocklist-delete-entry
Delete an entry from the Organizational Block List.
proofpoint-tp-blocklist-list
Get entries from the Organizational Block List.
proofpoint-tp-safelist-add-entry
Add an entry to the Organizational Safe List.
proofpoint-tp-safelist-delete-entry
Delete an entry from the Organizational Safe List.
proofpoint-tp-safelist-list
Get entries from the Organizational Safe List.

Source

ProofpointThreatProtection.py ProofpointThreatProtection_test.py ProofpointThreatProtection.yml ProofpointThreatProtection_description.md command_examples.txt

Download History Raw

## Proofpoint Threat Protection

### Proofpoint Threat Protection Integration Setup

To set up the Proofpoint Threat Protection API Cortex XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

#### To Create a New Threat Protection API Key

1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.
2. Click **+Create New**. The Create New Threat Protection API Key dialog box for the cluster appears.
3. Add a descriptive name for the key. 
4. Click **Generate Key** to create the key and secret.
5. The Create New Threat Protection API Key dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. **You will need the key and secret to obtain the authentication token for the API service**.

#### To Manage Previously Generated Threat Protection API Keys

1. In the Proofpoint Admin Portal, navigate to the API Key Management section.
2. For each API key previously generated there is an ellipsis providing two choices of action: **Renew** and **Revoke**. Select the action as needed.
  - **Renew** will extend the key expiration for one more year.
  - **Revoke** will permanently remove the key and it cannot be restored.

#### Additional Notes regarding Threat Protection API Keys

- Your deployment must be running release 8.20.X or greater, and have cloud-based configuration management enabled.
- Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to **Renew** it before permanently expiring it.
- Creating keys and revoking keys are logged as events in the **Audit Logs**.