Proofpoint Threat Response Parsing Rule

Details

Rules (XQL)

[INGEST:vendor = "proofpoint", product = "threat_response", target_dataset = "proofpoint_threat_response_raw", no_hit = keep]
filter to_string(updated_at) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter _time = updated_at;