Proofpoint Threat Response

Details

ID	`Proofpoint Threat Response`
Provider	Thoma Bravo
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the Proofpoint Threat Response integration to orchestrate and automate incident response.

Configure Proofpoint Threat Response in Cortex

Parameter	Description	Required
Server URL (e.g. https://192.168.0.1)		True
API Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
First fetch timestamp (“number” “time unit”, e.g., 12 hours, 7 days)	The time range for the initial data fetch. If timeout errors occur, consider changing this value.	False
Fetch limit - maximum number of incidents per fetch		False
Fetch delta - The delta time in each batch. e.g. 1 hour, 3 minutes.	The time range between create_after and created_before that is sent to the API when fetching older incidents. If timeout errors occur, consider changing this value.	False
Fetch incidents with specific event sources. Can be a list of comma separated values.		False
Fetch incidents with specific ‘Abuse Disposition’ values. Can be a list of comma separated values.		False
Fetch incident with specific states.		False
POST URL of the JSON alert source.	You can find this value by navigating to Sources -> JSON event source -> POST URL.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-tr-get-list

Gets items for the specified list.

Base Command

proofpoint-tr-get-list

Input

Argument Name	Description	Required
list-id	The ID of the list.	Required

Context Output

There is no context output for this command.

proofpoint-tr-add-to-list

Adds a member to the specified list.

Base Command

proofpoint-tr-add-to-list

Input

Argument Name	Description	Required
list-id	The list to add a member to.	Required
indicator	A comma-separated list of indicator values. Can be IP addresses, URLs, domains, or file hashes. For example: “192.168.1.1,192.168.1.2”.	Required
comment	A comment about the member.	Optional
expiration	The expiration of the member.	Optional

Context Output

There is no context output for this command.

proofpoint-tr-block-ip

Adds the supplied IP addresses to the specified IP block list.

Base Command

proofpoint-tr-block-ip

Input

Argument Name	Description	Required
ip	A comma-separated list of IP addresses to block list.	Required
expiration	The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.	Optional
blacklist_ip	The ID of the IP block list.	Required

Context Output

There is no context output for this command.

proofpoint-tr-block-domain

Adds the supplied domains to the specified block list.

Base Command

proofpoint-tr-block-domain

Input

Argument Name	Description	Required
domain	A comma-separated list of domains to add to the block list.	Required
expiration	The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.	Optional
blacklist_domain	The ID of the domain block list.	Required

Context Output

There is no context output for this command.

proofpoint-tr-search-indicator

Returns indicators from the specified list, according to the defined filter.

Base Command

proofpoint-tr-search-indicator

Input

Argument Name	Description	Required
list-id	The ID of the list in which to search.	Required
filter	The filter for the indicator search. For example, “1.1” will return [1.1.1.1, 22.22.1.1, 1.1.22.22].	Required

Context Output

There is no context output for this command.

proofpoint-tr-delete-indicator

Deletes an indicator from the specified list.

Base Command

proofpoint-tr-delete-indicator

Input

Argument Name	Description	Required
list-id	ID of the list from which to delete indicators.	Required
indicator	The indicator value to delete from the list. Can be an IP address, URL, domain, or file hash. For example: “demisto.com”.	Required

Context Output

There is no context output for this command.

proofpoint-tr-block-url

Adds the supplied URLs to the specified URL block list.

Base Command

proofpoint-tr-block-url

Input

Argument Name	Description	Required
url	A comma-separated list of URLs to add to the URL block list.	Required
expiration	The date and time the supplied URLs should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.	Optional
blacklist_url	The ID of the URL block list.	Required

Context Output

There is no context output for this command.

proofpoint-tr-block-hash

Adds the supplied file hashes to the specified file hash block list.

Base Command

proofpoint-tr-block-hash

Input

Argument Name	Description	Required
hash	A comma-separated list of file hashes to add to the file hash block list.	Required
expiration	The date and time the supplied file hashes should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.	Optional
blacklist_hash	The ID of the hash block list.	Required

Context Output

There is no context output for this command.

proofpoint-tr-list-incidents

Retrieves all incident metadata from Threat Response by specifying filter criteria such as the state of the incident or time of closure.

Base Command

proofpoint-tr-list-incidents

Input

Argument Name	Description	Required
state	State of the incidents to retrieve. Possible values are: new, open, assigned, closed, ignored.	Optional
created_after	Retrieve incidents that were created after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z. Possible values are: .	Optional
created_before	Retrieve incidents that were created before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.	Optional
closed_after	Retrieve incidents that were closed after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.	Optional
closed_before	Retrieve incidents that were closed before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.	Optional
expand_events	If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.	Optional
limit	The maximum number of incidents to return. The default value is 50.	Required

Context Output

Path	Type	Description
ProofPointTRAP.Incident.id	Number	The incident ID.
ProofPointTRAP.Incident.summary	String	The summary of the incident.
ProofPointTRAP.Incident.score	Number	The score of the incident from Proofpoint.
ProofPointTRAP.Incident.state	String	The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
ProofPointTRAP.Incident.created_at	Date	The date the incident was created.
ProofPointTRAP.Incident.updated_at	Date	The date the incident was last updated.
ProofPointTRAP.Incident.event_count	Number	The number of events attached to the incident.
ProofPointTRAP.Incident.false_positive_count	Number	The number of false positive events in the incident.
ProofPointTRAP.Incident.event_sources	String	The sources of the events.
ProofPointTRAP.Incident.assignee	String	The user assigned to the incident.
ProofPointTRAP.Incident.team	String	The team assigned to the incident.
ProofPointTRAP.Incident.hosts.attacker	String	The host attacker.
ProofPointTRAP.Incident.hosts.forensics	String	The host forensics.
ProofPointTRAP.Incident.incident_field_values.Severity	String	The severity of the incident.
ProofPointTRAP.Incident.incident_field_values.Abuse_disposition	String	The abuse disposition of the incident.
ProofPointTRAP.Incident.incident_field_values.Attack_vector	String	The attack vector of the incident.
ProofPointTRAP.Incident.incident_field_values.Classification	String	The classification of the incident.
ProofPointTRAP.Incident.events.id	Number	The event ID.
ProofPointTRAP.Incident.events.category	String	The event category.
ProofPointTRAP.Incident.events.alertType	String	The alert type of the event.
ProofPointTRAP.Incident.events.severity	String	The severity of the event.
ProofPointTRAP.Incident.events.source	String	The source of the event.
ProofPointTRAP.Incident.events.state	String	The state of the event.
ProofPointTRAP.Incident.events.attackDirection	String	The attack direction of the event.
ProofPointTRAP.Incident.events.received	Date	The time the incident was received.
ProofPointTRAP.Incident.events.emails.sender	String	The sender of the email.
ProofPointTRAP.Incident.events.emails.recipient	String	The recipient of the email.
ProofPointTRAP.Incident.events.emails.message_Id	String	The message ID of the email.
ProofPointTRAP.Incident.events.emails.message_delivery_time	Number	The delivery time of the message.
ProofPointTRAP.Incident.events.attackers.location	String	The location of the attacker.
ProofPointTRAP.Incident.events.falsePositive	Boolean	Whether this incident is a false positive.
ProofPointTRAP.Incident.events.threatname	String	The threat name.
ProofPointTRAP.Incident.events.description	String	The description of the event.
ProofPointTRAP.Incident.events.malwareName	String	The malware name.
ProofPointTRAP.Incident.quarantine_results.alertSource	String	The alert source.
ProofPointTRAP.Incident.quarantine_results.startTime	Date	The start time of the result.
ProofPointTRAP.Incident.quarantine_results.endTime	Date	The end time of the result.
ProofPointTRAP.Incident.quarantine_results.status	String	The status of the result.
ProofPointTRAP.Incident.quarantine_results.recipientType	String	The recipient type.
ProofPointTRAP.Incident.quarantine_results.recipient	String	The recipient email address.
ProofPointTRAP.Incident.quarantine_results.messageId	String	The message ID.
ProofPointTRAP.Incident.quarantine_results.isRead	Boolean	Whether the message has been read.
ProofPointTRAP.Incident.quarantine_results.wasUndone	String	Whether the message was undone.
ProofPointTRAP.Incident.quarantine_results.details	String	The details about the result.
ProofPointTRAP.Incident.successful_quarantines	Number	The number of successful quarantines.
ProofPointTRAP.Incident.failed_quarantines	Number	The number of failed quarantines.
ProofPointTRAP.Incident.pending_quarantines	Number	The number of pending quarantines.
ProofPointTRAP.Incident.events.emails.body	String	The body of the email.
ProofPointTRAP.Incident.events.emails.body_type	String	The format of the body.
ProofPointTRAP.Incident.events.emails.headers	Unknown	The email headers.
ProofPointTRAP.Incident.events.emails.urls	Unknown	The list of URLs from the email.
ProofPoint.Incident.event_ids	Unknown	The list of IDs attached to the incident.

proofpoint-tr-get-incident

Retrieves incident metadata from Threat Response.

Base Command

proofpoint-tr-get-incident

Input

Argument Name	Description	Required
incident_id	The ID value of the incident to retrieve (e.g. for incident INC-4000, the input for this argument should be 4000).	Required
expand_events	If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.	Optional

Context Output

Path	Type	Description
ProofPointTRAP.Incident.id	Number	The incident ID.
ProofPointTRAP.Incident.summary	String	The summary of the incident.
ProofPointTRAP.Incident.score	Number	The score of the incident from Proofpoint.
ProofPointTRAP.Incident.state	String	The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
ProofPointTRAP.Incident.created_at	Date	The date the incident was created.
ProofPointTRAP.Incident.updated_at	Date	The date the incident was last updated.
ProofPointTRAP.Incident.event_count	Number	The number of events attached to the incident.
ProofPointTRAP.Incident.false_positive_count	Number	The number of false positive events in the incident.
ProofPointTRAP.Incident.event_sources	String	The sources of the events.
ProofPointTRAP.Incident.assignee	String	The user assigned to the incident.
ProofPointTRAP.Incident.team	String	The team assigned to the incident.
ProofPointTRAP.Incident.hosts.attacker	String	The host attacker.
ProofPointTRAP.Incident.hosts.forensics	String	The host forensics.
ProofPointTRAP.Incident.incident_field_values.Severity	String	The severity of the incident.
ProofPointTRAP.Incident.incident_field_values.Abuse_disposition	String	The abuse disposition of the incident.
ProofPointTRAP.Incident.incident_field_values.Attack_vector	String	The attack vector of the incident.
ProofPointTRAP.Incident.incident_field_values.Classification	String	The classification of the incident.
ProofPointTRAP.Incident.events.id	Number	The event ID.
ProofPointTRAP.Incident.events.category	String	The event category.
ProofPointTRAP.Incident.events.alertType	String	The alert type of the event.
ProofPointTRAP.Incident.events.severity	String	The severity of the event.
ProofPointTRAP.Incident.events.source	String	The source of the event.
ProofPointTRAP.Incident.events.state	String	The state of the event.
ProofPointTRAP.Incident.events.attackDirection	String	The attack direction of the event
ProofPointTRAP.Incident.events.received	Date	The date the incident was received.
ProofPointTRAP.Incident.events.emails.sender	String	The sender of the email.
ProofPointTRAP.Incident.events.emails.recipient	String	The recipient of the email.
ProofPointTRAP.Incident.events.emails.message_Id	String	The message ID of the email.
ProofPointTRAP.Incident.events.emails.message_delivery_time	Number	The time the message was delivered.
ProofPointTRAP.Incident.events.attackers.location	String	The location of the attacker.
ProofPointTRAP.Incident.events.falsePositive	Boolean	Whether this incident is a false positive.
ProofPointTRAP.Incident.events.threatname	String	The threat name.
ProofPointTRAP.Incident.events.description	String	The description of the event.
ProofPointTRAP.Incident.events.malwareName	String	The malware name.
ProofPointTRAP.Incident.quarantine_results.alertSource	String	The alert source.
ProofPointTRAP.Incident.quarantine_results.startTime	Date	The start time of the result.
ProofPointTRAP.Incident.quarantine_results.endTime	Date	The end time of the result.
ProofPointTRAP.Incident.quarantine_results.status	String	The status of the result.
ProofPointTRAP.Incident.quarantine_results.recipientType	String	The recipient type.
ProofPointTRAP.Incident.quarantine_results.recipient	String	The recipient email address.
ProofPointTRAP.Incident.quarantine_results.messageId	String	The message ID.
ProofPointTRAP.Incident.quarantine_results.isRead	Boolean	Whether the message has been read.
ProofPointTRAP.Incident.quarantine_results.wasUndone	String	Whether the message was undone.
ProofPointTRAP.Incident.quarantine_results.details	String	The details about the result.
ProofPointTRAP.Incident.successful_quarantines	Number	The number of successful quarantines.
ProofPointTRAP.Incident.failed_quarantines	Number	The number of failed quarantines.
ProofPointTRAP.Incident.pending_quarantines	Number	The number of pending quarantines.
ProofPointTRAP.Incident.events.emails.body	String	The body of the email.
ProofPointTRAP.Incident.events.emails.body_type	String	The format of the body.
ProofPointTRAP.Incident.events.emails.headers	Unknown	The email headers.
ProofPointTRAP.Incident.events.emails.urls	Unknown	The list of URLs from the email.
ProofPoint.Incident.event_ids	Unknown	The list of IDs attached to the incident.

proofpoint-tr-update-incident-comment

Adds comments to an existing Threat Response incident, by incident ID.

Base Command

proofpoint-tr-update-incident-comment

Input

Argument Name	Description	Required
incident_id	The ID value of the incident to add the comment to (e.g. for incident INC-4000, the input for this argument should be 4000).	Required
details	The details of the comments.	Required
comments	The summary of the comments.	Required

Context Output

Path	Type	Description
ProofPointTRAP.IncidentComment.id	Number	The ID of the comment.
ProofPointTRAP.IncidentComment.incident_id	Number	The ID of the incident.
ProofPointTRAP.IncidentComment.response_id	Number	The ID of the response.
ProofPointTRAP.IncidentComment.user_id	String	The ID of the user.
ProofPointTRAP.IncidentComment.history_type	String	The history type.
ProofPointTRAP.IncidentComment.state_from	String	The state from of the incident.
ProofPointTRAP.IncidentComment.state_to	String	The state to of the incident.
ProofPointTRAP.IncidentComment.summary	String	The summary of the comments.
ProofPointTRAP.IncidentComment.detail	String	The details of the comment.
ProofPointTRAP.IncidentComment.created_at	Date	The date the incident was created.
ProofPointTRAP.IncidentComment.updated_at	Date	The date the incident was last updated.

proofpoint-tr-add-user-to-incident

Assigns a user to an incident as a target or attacker.

Base Command

proofpoint-tr-add-user-to-incident

Input

Argument Name	Description	Required
incident_id	The ID value of the incident to add the user to (e.g. for incident INC-4000, the input for this argument should be 4000).	Required
targets	The list of targets to add to the incident.	Required
attackers	The list of attackers to add to the incident.	Required

Context Output

There is no context output for this command.

proofpoint-tr-ingest-alert

Ingest an alert into Threat Response.

Base Command

proofpoint-tr-ingest-alert

Input

Argument Name	Description	Required
post_url_id	The POST URL of the JSON alert source. You can find it by navigating to Sources -> JSON event source -> POST URL.	Optional
json_version	The Threat Response JSON version. Possible values are: 2.0, 1.0. Default is 2.0.	Required
attacker	An attacker object in JSON format : “{“attacker” : {…}}”. The attacker object must contain one of [“ip_address”, mac_address”, “host_name”, “url”, “user”] keys. You can also add the “port” key to the object. For more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
classification	The alert classification shown as “Alert Type” in the TRAP UI. Possible values are: malware, policy-violation, vulnerability, network, spam, phish, command-and-control, data-match, authentication, system-behavior, impostor, reported-abuse, unknown.	Optional
cnc_hosts	The Command and Control host information in JSON format : “{“cnc_hosts”: [{“host” : “-“, “port”: “-“}, …]}”. Note: Every item of the “cnc_hosts” list is in JSON format. For more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
detector	The threat detection tool such as Firewall and IPS/IDS systems (in the format: “{“detector” : {…}}”), which generated the original alert. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
email	The email metadata related to the alert, in JSON format: “{“email”: {…}}”. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
forensics_hosts	The forensics host information in JSON format : “{“forensics_hosts”: [{“host” : “-“, “port”: “-“}…]}”. Note: Every item of the “forensics_hosts” list is in JSON format. For more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
link_attribute	The attribute to link alerts to. Possible values are: target_ip_address, target_hostname, target_machine_name, target_user, target_mac_address, attacker_ip_address, attacker_hostname, attacker_machine_name, attacker_user, attacker_mac_address, email_recipient, email_sender, email_subject, message_id, threat_filename, threat_filehash.	Optional
severity	The severity of the alert. Possible values are: info, minor, moderate, major, critical, Informational, Low, Medium, High, Critical.	Optional
summary	The alert summary. This argument will populate the Alert Details field.	Optional
target	The target host information in JSON format : “{“target”: {…}}”. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
threat_info	The threat information in JSON format: “{“threat_info”: {…}}”. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional
custom_fields	A JSON object for collecting custom name-value pairs as part of the JSON alert sent to Threat Response, in the format: “{“custom_fields”: {..}}”. Although there is no limit to the number of custom fields, Proofpoint recommends keeping it to 10 or fewer fields. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under “JSON Alert Source 2.0”.	Optional

Context Output

There is no context output for this command.

proofpoint-tr-close-incident

Close an incident

Base Command

proofpoint-tr-close-incident

Input

Argument Name	Description	Required
incident_id	The ID value of the incident to close.	Required
details	The details for the closure notes.	Required
summary	The summary for the closure notes.	Required

Context Output

There is no context output for this command.

proofpoint-tr-verify-quarantine

Verify if an email has been quarantined.

Base Command

proofpoint-tr-verify-quarantine

Input

Argument Name	Description	Required
message_id	The ID value of an email.	True
time	The creation time of the incident in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.	True
recipient	The email recipient.	True
limit_quarantine_occurred_time	Whether or not to limit the results to include only quarantines that occurred within a limited time after alert creation. Automated quarantine actions for example typically occur within 120 seconds of alert firing. Manual actions executed by human may take longer. Default is True.	False
quarantine_limit	Only used if ‘limit_quarantine_occurred_time’ argument is set to true. Sets a limit on the quarantines retrieved to include only those where the time difference between alert time and quarantined time is less than the number of seconds specified. The time is in seconds. Default is 120.	False
fetch_delta	The time frame (in hours) used to identify the size of batches when retrieving the messages. e.g., 12. Default is 6.	False
check_exact_reception_time	If true, the command checks for quarantined emails with the exact reception time of the email. If false, the verification of the quarantined email only uses the message ID and the recipient email. Default is true.	False

Context Output

Path	Type	Description
ProofPointTRAP.Quarantine	String	The result of the quarantine.

Command Example

!proofpoint-tr-verify-quarantine messageid=<message_id_example> time="2022-06-02T17:22:45Z" recipient=example@example.com

Context Example

{
    "ProofPointTRAP": {
        "Quarantine": [
            {
                "alert": {
                    "id": 1030,
                    "time": "2022-06-02T17:33:18Z"
                },
                "incident": {
                    "id": 265,
                    "time": "2022-06-02T17:33:18Z"
                },
                "quarantine": {
                    "alertSource": "Admin Portal",
                    "details": "Success",
                    "endTime": "2022-06-02T17:33:37.926Z",
                    "isRead": "false",
                    "messageId": "message_id_example",
                    "recipient": "example@example.com",
                    "recipientType": "Original Recipient",
                    "startTime": "2022-06-02T17:33:20.352Z",
                    "status": "successful",
                    "wasUndone": "false"
                }
            },
            {
                "alert": {
                    "id": 1030,
                    "time": "2022-06-02T17:33:18Z"
                },
                "incident": {
                    "id": 265,
                    "time": "2022-06-02T17:33:18Z"
                },
                "quarantine": {
                    "alertSource": "Admin Portal",
                    "details": "Success",
                    "endTime": "2022-06-02T17:33:37.321Z",
                    "isRead": "false",
                    "messageId": "message_id_example",
                    "recipient": "example@example.com",
                    "recipientType": "Original Recipient",
                    "startTime": "2022-06-02T17:33:20.283Z",
                    "status": "successful",
                    "wasUndone": "false"
                }
            }
        ]
    }
}

Configuration parameters

url — Server URL (e.g. https://192.168.0.1) (required)
credentials —
apikey — API Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
fetch_limit — Fetch limit - maximum number of incidents per fetch
fetch_delta — Fetch delta - The delta time in each batch. e.g. 1 hour, 3 minutes.
states — Fetch incident with specific states.
event_sources — Fetch incidents with specific event sources. Can be a list of comma separated values.
abuse_disposition — Fetch incidents with specific 'Abuse Disposition' values. Can be a list of comma separated values.
post_url_id — POST URL of the JSON alert source.

Commands (15)

proofpoint-tr-add-to-list
Adds a member to the specified list.
proofpoint-tr-add-user-to-incident
Assigns a user to an incident as a target or attacker.
proofpoint-tr-block-domain
Adds the supplied domains to the specified block list.
proofpoint-tr-block-hash
Adds the supplied file hashes to the specified file hash block list.
proofpoint-tr-block-ip
Adds the supplied IP addresses to the specified IP block list.
proofpoint-tr-block-url
Adds the supplied URLs to the specified URL block list.
proofpoint-tr-close-incident
Close a specified incident.
proofpoint-tr-delete-indicator
Deletes an indicator from the specified list.
proofpoint-tr-get-incident
Retrieves incident metadata from Threat Response.
proofpoint-tr-get-list
Gets items for the specified list.
proofpoint-tr-ingest-alert
Ingest an alert into Threat Response.
proofpoint-tr-list-incidents
Retrieves all incident metadata from Threat Response by specifying filter criteria such as the state of the incident or time of closure.
proofpoint-tr-search-indicator
Returns indicators from the specified list, according to the defined filter.
proofpoint-tr-update-incident-comment
Adds comments to an existing Threat Response incident, by incident ID.
proofpoint-tr-verify-quarantine
Verify if an email has been quarantined.

Source

ProofpointThreatResponse.py ProofpointThreatResponse_test.py ProofpointThreatResponse.yml ProofpointThreatResponse_description.md

Download History Raw

category: Network Security
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: Proofpoint Threat Response
  version: -1
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key
  hiddenusername: true
  section: Connect
  required: false
- display: API Key
  name: apikey
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: 'false'
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '12 hours'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  additionalinfo: The time range for the initial data fetch. If timeout errors occur, consider changing this value.
  section: Collect
  required: false
- defaultvalue: '50'
  display: Fetch limit - maximum number of incidents per fetch
  name: fetch_limit
  type: 0
  section: Collect
  required: false
- display: Fetch delta - The delta time in each batch. e.g. 1 hour, 3 minutes.
  name: fetch_delta
  type: 0
  defaultvalue: 6 hours
  additionalinfo: The time range between create_after and created_before that is sent to the API when fetching older incidents. If timeout errors occur, consider changing this value.
  section: Collect
  required: false
- display: Fetch incident with specific states.
  name: states
  type: 16
  section: Collect
  advanced: false
  required: false
  options:
  - new
  - open
  - assigned
  - closed
  - ignored
  additionalinfo: >
    When fetch is enable you must provide this argument. Possible values are: new, open, assigned, closed or ignored.
- display: Fetch incidents with specific event sources. Can be a list of comma separated values.
  name: event_sources
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch incidents with specific 'Abuse Disposition' values. Can be a list of comma separated values.
  name: abuse_disposition
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: You can find this value by navigating to Sources -> JSON event source -> POST URL.
  display: POST URL of the JSON alert source.
  name: post_url_id
  type: 0
  section: Collect
  advanced: true
  required: false
description: Use the Proofpoint Threat Response integration to orchestrate and automate incident response.
display: Proofpoint Threat Response
name: Proofpoint Threat Response
script:
  commands:
  - arguments:
    - description: The ID of the list.
      name: list-id
      required: true
    description: Gets items for the specified list.
    name: proofpoint-tr-get-list
  - arguments:
    - description: The list to add a member to.
      name: list-id
      required: true
    - description: 'A comma-separated list of indicator values. Can be IP addresses, URLs, domains, or file hashes. For example: "192.168.1.1,192.168.1.2".'
      isArray: true
      name: indicator
      required: true
    - description: A comment about the member.
      name: comment
    - description: The member expiration.
      name: expiration
    description: Adds a member to the specified list.
    execution: true
    name: proofpoint-tr-add-to-list
  - arguments:
    - description: A comma-separated list of IP addresses to add to block list.
      isArray: true
      name: ip
      required: true
    - description: 'The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the IP block list.
      name: blacklist_ip
      required: true
    description: Adds the supplied IP addresses to the specified IP block list.
    execution: true
    name: proofpoint-tr-block-ip
  - arguments:
    - description: A comma-separated list of domains to add to the block list.
      isArray: true
      name: domain
      required: true
    - description: 'The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the domain block list.
      name: blacklist_domain
      required: true
    description: Adds the supplied domains to the specified block list.
    name: proofpoint-tr-block-domain
  - arguments:
    - description: The ID of the list in which to search.
      name: list-id
      required: true
    - description: The filter for the indicator search. For example, "1.1" will return [1.1.1.1, 22.22.1.1, 1.1.22.22].
      name: filter
      required: true
    description: Returns indicators from the specified list, according to the defined filter.
    name: proofpoint-tr-search-indicator
  - arguments:
    - description: The ID of the list from which to delete indicators.
      name: list-id
      required: true
    - description: 'The indicator value to delete from the list. Can be an IP address, URL, domain, or file hash. For example: "demisto.com".'
      name: indicator
      required: true
    description: Deletes an indicator from the specified list.
    name: proofpoint-tr-delete-indicator
  - arguments:
    - description: A comma-separated list of URLs to add to the URL block list.
      isArray: true
      name: url
      required: true
    - description: 'The date and time the supplied URLs should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the URL block list.
      name: blacklist_url
      required: true
    description: Adds the supplied URLs to the specified URL block list.
    name: proofpoint-tr-block-url
  - arguments:
    - description: A comma-separated list of file hashes to add to the file hash block list.
      isArray: true
      name: hash
      required: true
    - description: 'The date and time the supplied file hashes should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the hash block list.
      name: blacklist_hash
      required: true
    description: Adds the supplied file hashes to the specified file hash block list.
    name: proofpoint-tr-block-hash
  - arguments:
    - auto: PREDEFINED
      description: The state of the incidents to retrieve.
      name: state
      predefined:
      - new
      - open
      - assigned
      - closed
      - ignored
    - description: 'Retrieve incidents that were created after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: created_after
      predefined:
      - ''
    - description: 'Retrieve incidents that were created before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: created_before
    - description: 'Retrieve incidents that were closed after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: closed_after
    - description: 'Retrieve incidents that were closed before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: closed_before
    - auto: PREDEFINED
      description: If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.
      name: expand_events
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '50'
      description: The maximum number of incidents to return.
      name: limit
      required: true
    description: Retrieves all incident metadata from Threat Response by specifying filter criteria such as the state of the incident or time of closure.
    name: proofpoint-tr-list-incidents
    outputs:
    - contextPath: ProofPointTRAP.Incident.id
      description: The incident ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.summary
      description: The summary of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.score
      description: The score of the incident from Proofpoint.
      type: Number
    - contextPath: ProofPointTRAP.Incident.state
      description: The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
      type: String
    - contextPath: ProofPointTRAP.Incident.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.Incident.updated_at
      description: The date the incident was last updated.
      type: Date
    - contextPath: ProofPointTRAP.Incident.event_count
      description: The number of events attached to the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.false_positive_count
      description: The number of false positive events in the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.event_sources
      description: The sources of the events.
      type: String
    - contextPath: ProofPointTRAP.Incident.assignee
      description: The user assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.team
      description: The team assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.attacker
      description: The host attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.forensics
      description: The host forensics.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Severity
      description: The severity of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Abuse_disposition
      description: The abuse disposition of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Attack_vector
      description: The attack vector of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Classification
      description: The classification of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.id
      description: The event ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.category
      description: The event category.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.alertType
      description: The alert type of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.severity
      description: The severity of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.source
      description: The source of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.state
      description: The state of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.attackDirection
      description: The attack direction of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.received
      description: The time the incident was received.
      type: Date
    - contextPath: ProofPointTRAP.Incident.events.emails.sender
      description: The sender of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.recipient
      description: The recipient of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_Id
      description: The message ID of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_delivery_time
      description: The delivery time of the message.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.attackers.location
      description: The location of the attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.falsePositive
      description: Whether this incident is a false positive.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.events.threatname
      description: The threat name.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.description
      description: The description of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.malwareName
      description: The malware name.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.alertSource
      description: The alert source.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.startTime
      description: The start time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.endTime
      description: The end time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.status
      description: The status of the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipientType
      description: The recipient type.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipient
      description: The recipient email address.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.messageId
      description: The message ID.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.isRead
      description: Whether the message has been read.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.quarantine_results.wasUndone
      description: Whether the message was undone.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.details
      description: The details about the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.successful_quarantines
      description: The number of successful quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.failed_quarantines
      description: The number of failed quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.pending_quarantines
      description: The number of pending quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.emails.body
      description: The body of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.body_type
      description: The format of the body.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.headers
      description: The email headers.
      type: Unknown
    - contextPath: ProofPointTRAP.Incident.events.emails.urls
      description: The list of URLs from the email.
      type: Unknown
    - contextPath: ProofPoint.Incident.event_ids
      description: The list of IDs attached to the incident.
      type: Unknown
  - arguments:
    - default: true
      description: The ID value of the incident to retrieve (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.
      name: expand_events
      predefined:
      - 'true'
      - 'false'
    description: Retrieves incident metadata from Threat Response.
    name: proofpoint-tr-get-incident
    outputs:
    - contextPath: ProofPointTRAP.Incident.id
      description: The incident ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.summary
      description: The summary of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.score
      description: The score of the incident from Proofpoint.
      type: Number
    - contextPath: ProofPointTRAP.Incident.state
      description: The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
      type: String
    - contextPath: ProofPointTRAP.Incident.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.Incident.updated_at
      description: The date the incident was last updated.
      type: Date
    - contextPath: ProofPointTRAP.Incident.event_count
      description: The number of events attached to the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.false_positive_count
      description: The number of false positive events in the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.event_sources
      description: The sources of the events.
      type: String
    - contextPath: ProofPointTRAP.Incident.assignee
      description: The user assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.team
      description: The team assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.attacker
      description: The host attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.forensics
      description: The host forensics.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Severity
      description: The severity of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Abuse_disposition
      description: The abuse disposition of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Attack_vector
      description: The attack vector of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Classification
      description: The classification of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.id
      description: The event ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.category
      description: The event category.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.alertType
      description: The alert type of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.severity
      description: The severity of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.source
      description: The source of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.state
      description: The state of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.attackDirection
      description: The attack direction of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.received
      description: The date the incident was received.
      type: Date
    - contextPath: ProofPointTRAP.Incident.events.emails.sender
      description: The sender of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.recipient
      description: The recipient of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_Id
      description: The message ID of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_delivery_time
      description: The time the message was delivered.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.attackers.location
      description: The location of the attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.falsePositive
      description: Whether this incident is a false positive.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.events.threatname
      description: The threat name.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.description
      description: The description of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.malwareName
      description: The malware name.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.alertSource
      description: The alert source.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.startTime
      description: The start time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.endTime
      description: The end time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.status
      description: The status of the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipientType
      description: The recipient type.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipient
      description: The recipient email address.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.messageId
      description: The message ID.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.isRead
      description: Whether the message has been read.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.quarantine_results.wasUndone
      description: Whether the message was undone.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.details
      description: The details about the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.successful_quarantines
      description: The number of successful quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.failed_quarantines
      description: The number of failed quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.pending_quarantines
      description: The number of pending quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.emails.body
      description: The body of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.body_type
      description: The format of the body.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.headers
      description: The email headers.
      type: Unknown
    - contextPath: ProofPointTRAP.Incident.events.emails.urls
      description: The list of URLs from the email.
      type: Unknown
    - contextPath: ProofPoint.Incident.event_ids
      description: The list of IDs attached to the incident.
      type: Unknown
  - arguments:
    - description: The ID value of the incident to add the comment to (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - description: 'The details of the comments. '
      name: details
      required: true
    - description: The summary of the comments.
      name: comments
      required: true
    description: Adds comments to an existing Threat Response incident, by incident ID.
    name: proofpoint-tr-update-incident-comment
    outputs:
    - contextPath: ProofPointTRAP.IncidentComment.id
      description: The ID of the comment.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.incident_id
      description: The ID of the incident.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.response_id
      description: The ID of the response.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.user_id
      description: The ID of the user.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.history_type
      description: The history type.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.state_from
      description: The state from of the incident.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.state_to
      description: The state to of the incident.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.summary
      description: The summary of the comments.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.detail
      description: The details of the comment.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.IncidentComment.updated_at
      description: The date the incident was last updated.
      type: Date
  - arguments:
    - description: The ID value of the incident to add the user to (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - description: The list of targets to add to the incident.
      isArray: true
      name: targets
      required: true
    - description: The list of attackers to add to the incident.
      isArray: true
      name: attackers
      required: true
    description: Assigns a user to an incident as a target or attacker.
    name: proofpoint-tr-add-user-to-incident
  - arguments:
    - description: The incident ID to close.
      name: incident_id
    - description: The incident closure details.
      name: details
    - description: The incident closure summary.
      name: summary
    description: Close a specified incident.
    name: proofpoint-tr-close-incident
  - arguments:
    - description: POST URL of the JSON alert source. You can find it by navigating to Sources -> JSON event source -> POST URL.
      name: post_url_id
    - auto: PREDEFINED
      defaultValue: '2.0'
      description: The Threat Response JSON version.
      name: json_version
      predefined:
      - '2.0'
      - '1.0'
      required: true
    - description: 'An attacker object in JSON format : "{"attacker" : {...}}". The attacker object must contain one of ["ip_address", mac_address", "host_name", "url", "user"] keys. You can also add the "port" key to the object. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: attacker
    - auto: PREDEFINED
      description: The alert classification shown as "Alert Type" in the TRAP UI.
      name: classification
      predefined:
      - malware
      - policy-violation
      - vulnerability
      - network
      - spam
      - phish
      - command-and-control
      - data-match
      - authentication
      - system-behavior
      - impostor
      - reported-abuse
      - unknown
    - description: 'The Command and Control host information in JSON format : "{"cnc_hosts": [{"host" : "-", "port": "-"}, ...]}". Note: Every item of the "cnc_hosts" list is in JSON format. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: cnc_hosts
    - description: 'The threat detection tool such as Firewall and IPS/IDS systems (in the format: "{"detector" : {...}}"), which generated the original alert. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: detector
    - description: 'The email metadata related to the alert, in JSON format: "{"email": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: email
    - description: 'The forensics host information in JSON format : "{"forensics_hosts": [{"host" : "-", "port": "-"}...]}". Note: Every item of the "forensics_hosts" list is in JSON format. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: forensics_hosts
    - auto: PREDEFINED
      description: The attribute to link alerts to.
      name: link_attribute
      predefined:
      - target_ip_address
      - target_hostname
      - target_machine_name
      - target_user
      - target_mac_address
      - attacker_ip_address
      - attacker_hostname
      - attacker_machine_name
      - attacker_user
      - attacker_mac_address
      - email_recipient
      - email_sender
      - email_subject
      - message_id
      - threat_filename
      - threat_filehash
    - auto: PREDEFINED
      description: The severity of the alert.
      name: severity
      predefined:
      - info
      - minor
      - moderate
      - major
      - critical
      - Informational
      - Low
      - Medium
      - High
      - Critical
    - description: The alert summary. This argument will populate the Alert Details field.
      name: summary
    - description: 'The target host information in JSON format : "{"target": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: target
    - description: 'The threat information in JSON format: "{"threat_info": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: threat_info
    - description: 'A JSON object for collecting custom name-value pairs as part of the JSON alert sent to Threat Response, in the format: "{"custom_fields": {..}}". Although there is no limit to the number of custom fields, Proofpoint recommends keeping it to 10 or fewer fields. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: custom_fields
    description: Ingest an alert into Threat Response.
    name: proofpoint-tr-ingest-alert
  - arguments:
    - description: The message ID of the email.
      name: message_id
      required: true
    - description: The recipient of the email.
      name: recipient
      required: true
    - description: 'The reception time of the email in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: time
      required: true
    - name: limit_quarantine_occurred_time
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      description: Whether or not to limit the results to include only quarantines that occurred within a limited time after alert creation.
      defaultValue: "True"
    - name: quarantine_limit
      description: Only used if 'limit_quarantine_occurred_time' argument is set to true. Sets a limit on the quarantines retrieved to include only those where the time difference between alert time and quarantined time is less than the number of seconds specified. The time is in seconds.
      defaultValue: "120"
    - name: fetch_delta
      defaultValue: '6'
      description: The time frame (in hours) used to identify the size of batches when retrieving the messages. e.g., 12.
    - name: check_exact_reception_time
      defaultValue: 'true'
      description: If true, the command checks for quarantined emails with the exact reception time of the email. If false, the verification of the quarantined email only uses the message ID and the recipient email.
    outputs:
    - contextPath: ProofPointTRAP.Quarantine
      description: Results of the email quarantine operation.
      type: String
    description: Verify if an email has been quarantined.
    name: proofpoint-tr-verify-quarantine
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No test
fromversion: 5.0.0