Proofpoint Cloud Threat Response (v1.0.2)
Proofpoint Cloud Threat Response (CTR) is the cloud-based alternative to TRAP (Threat Response Auto-Pull). known for its effective post-delivery remediation capabilities. Not only is this solution easy to use, but it also automates post-detection incident response and remediation tasks that slow down security teams.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Case Management
Integrations (1)
- Proofpoint Cloud Threat Response
Layouts (1)
- Cloud Threat Response Incident
README
Proofpoint Cloud Threat Response
Proofpoint Cloud Threat Response (CTR) is the cloud-based alternative to Proofpoint TRAP (Threat Response Auto-Pull). It automates post-detection incident response and remediation tasks.
What does this pack do?
- Fetches Proofpoint Cloud Threat Response incidents into Cortex for case management.
- Lists and filters incidents by source, verdict, disposition, confidence, state, time range, or specific IDs.
- Retrieves detailed metadata (activities, summary, dispositions) for a specific incident.
Use Cases
- Case management: Fetch CTR incidents to work inside Cortex. Closure of incidents is performed in the CTR UI (the CTR API does not currently expose a close-incident endpoint).