Proofpoint Email Security Event Collector

Collects events for Proofpoint Email Security using the streaming API.

Category

Analytics & SIEM

Pack

ProofpointEmailSecurity

Configuration parameters

• host — Server URL (required)
• cluster_id — Cluster ID (required)
• api_key — (required)
• fetch_interval — Fetch interval in seconds (required)
• longRunning — Long Running Instance
• proxy — Use system proxy settings
• event_types — Event types to fetch
• isFetchEvents — Fetch events

Commands (2)

• proofpoint-es-get-events — Retrieves events from the Proofpoint Email Security PoD archive for a specified time range to backfill gaps in fetched events. This command is intended for development and debugging purposes and is to be used with caution after consulting with engineering, as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.
• proofpoint-es-get-last-run-results — Retrieves the results of a connection attempt to Proofpoint, indicating whether it was successful or failed and why. If event fetching has been initiated, this command provides the results of the most recent fetch attempt.