commonfields:
  id: Proofpoint Email Security Event Collector
  version: -1
name: Proofpoint Email Security Event Collector
display: Proofpoint Email Security Event Collector
category: Analytics & SIEM
provider: Thoma Bravo
description: Collects events for Proofpoint Email Security using the streaming API.
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL
  name: host
  type: 0
  defaultvalue: wss://logstream.proofpoint.com:443
  required: true
  section: Connect
- display: Cluster ID
  name: cluster_id
  type: 0
  required: true
  additionalinfo: The user group ID.
  section: Connect
- displaypassword: API key
  name: api_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Fetch interval in seconds
  name: fetch_interval
  type: 0
  defaultvalue: 60
  required: true
  section: Collect
- defaultvalue: 'true'
  display: Long Running Instance
  hidden: true
  name: longRunning
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Collect
- additionalinfo: Denotes which event type to fetch, if not provided will fetch all kinds.
  display: Event types to fetch
  name: event_types
  type: 16
  required: false
  options:
  - message
  - maillog
  - audit
  section: Collect
  advanced: true
  defaultvalue: message,maillog,audit
- display: Fetch events  # Checkbox should be visible on all supported products/modules to allow any user to disable event fetching before running the "!proofpoint-es-get-events" command
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: "true"
script:
  script: ""
  type: python
  commands:
  - name: "proofpoint-es-get-last-run-results"
    description: Retrieves the results of a connection attempt to Proofpoint, indicating whether it was successful or failed and why. If event fetching has been initiated, this command provides the results of the most recent fetch attempt.
  - name: "proofpoint-es-get-events"
    description: "Retrieves events from the Proofpoint Email Security PoD archive for a specified time range to backfill gaps in fetched events. This command is intended for development and debugging purposes and is to be used with caution after consulting with engineering, as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism."
    arguments:
    - name: "since_time"
      description: "The start of the time range to fetch events from. E.g., '3 days ago', '2025-01-01T10:00:00'. Rounds down to the nearest hour."
      required: true
    - name: "to_time"
      description: "The end of the time range to fetch events from. E.g., '2 days ago', '2025-01-01T11:00:00'. Rounds up to the nearest hour."
      required: true
    - name: "timezone_offset"
      description: "The UTC timezone offset in hours to apply to the since_time and to_time arguments. E.g. -5 for UTC-5."
      required: false
    - name: "event_types"
      description: "A comma-separated list of event types to fetch. If not provided, all types will be retrieved."
      required: false
      isArray: true
      auto: PREDEFINED
      predefined:
      - message
      - maillog
      - audit
    - name: "limit"
      description: "The maximum number of events to fetch per specified event type."
      required: false
      defaultValue: "10"
    - name: "should_push_events"
      description: If true, the command will push the events to the Cortex XSIAM dataset; otherwise, it will only display them. 
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
  dockerimage: demisto/netutils:1.0.0.10187688
  longRunning: true
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests
supportedModules:
- xsiam