category: Network Security
provider: Thoma Bravo
sectionorder:
- Connect
commonfields:
  id: Proofpoint Protection Server v2
  version: -1
configuration:
- display: Server URL (e.g., https://xxxxxxxx.pphosted.com:10000)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Request Timeout
  name: timeout
  type: 0
  required: false
  section: Connect
  advanced: true
  defaultvalue: '60'
  additionalinfo: The timeout for HTTP(S) requests (in seconds) to the Proofpoint server.
description: Proofpoint email security appliance.
display: Proofpoint Protection Server v2
name: Proofpoint Protection Server v2
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: 'Final disposition action message. Possible values are: "accept", "continue", "discard", "redirect", "reject", "retry".'
      name: action
      predefined:
      - accept
      - continue
      - discard
      - redirect
      - reject
      - retry
    - defaultValue: 24 hours
      description: Time from when the search should begin. Can be either free text (<number> <time unit>, e.g., 12 hours, 7 days) or ISO-8601 (YYYY-MM-DDThh:mm:ssZ, e.g., 2020-01-25T10:00:00Z).
      name: start_time
    - description: Time of when the search should end. Can be either free text (<number> <time unit>, e.g., 12 hours, 7 days) or ISO-8601 (YYYY-MM-DDThh:mm:ssZ, e.g., 2020-01-25T10:00:00Z).
      name: end_time
    - description: Comma-separated list of the detected virus names that infected the message.
      name: virus
    - description: Email address of the sender.
      name: sender
    - description: Email address of the recipient.
      name: recipient
    - description: Comma-separated list of the message attachments.
      name: attachment
    - description: ID of the message queue.
      name: queue_id
    - description: The host or IP address of the sent email message.
      name: host
    - description: The SID of the email message.
      name: sid
    - description: The subject of the email message.
      name: subject
    - description: The global unique ID of the email message.
      name: guid
    - description: The ID of the header message. This corresponds to the Message ID field in the UI.
      name: message_id
    - defaultValue: '100'
      description: The maximum number of email messages to return. The maximum value is set by the com.proofpoint.pss.query.default-count value in the filter.cfg file.
      name: limit
    description: Trace and analyze information about messages after they have been filtered by the Proofpoint Protection Server.
    name: proofpoint-pps-smart-search
    outputs:
    - contextPath: Proofpoint.SmartSearch.Rule_ID
      description: The ID of the message rule (e.g., system).
      type: String
    - contextPath: Proofpoint.SmartSearch.Disposition_Action
      description: Message disposition action.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sendmail_Action
      description: Message send mail action.
      type: String
    - contextPath: Proofpoint.SmartSearch.Attachment_Names
      description: Names of the email attachments.
      type: String
    - contextPath: Proofpoint.SmartSearch.Recipients
      description: Email addresses of the recipient of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.SendmailRaw_Log
      description: The raw log of the send mail email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.GUID
      description: GUID of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Date
      description: Date of the email message.
      type: Date
    - contextPath: Proofpoint.SmartSearch.Raw_Log
      description: Raw log of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sender_Host
      description: The sender host of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Module_ID
      description: The module ID of the email message (e.g., access).
      type: String
    - contextPath: Proofpoint.SmartSearch.Sender_IP_Address
      description: IP address of the email message sender.
      type: String
    - contextPath: Proofpoint.SmartSearch.Quarantine_Folder
      description: The email message quarantine folder.
      type: String
    - contextPath: Proofpoint.SmartSearch.QID
      description: The queue ID of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Quarantine_Rule
      description: The quarantine rule of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Spam_Score
      description: The spam score of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.country
      description: The country of the email message (e.g., **).
      type: String
    - contextPath: Proofpoint.SmartSearch.TLS
      description: The TLS of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Policy_Routes
      description: Comma-separated list of mail message policy routes (e.g., allow_relay,firewallsafe).
      type: String
    - contextPath: Proofpoint.SmartSearch.current_folder
      description: The current folder of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.FID
      description: The folder ID of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.module_rules
      description: The module rules of the email message (e.g., access.system).
      type: String
    - contextPath: Proofpoint.SmartSearch.PE_Recipients
      description: The PE recipients of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Virus_Names
      description: The virus names of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sendmail_Errorcode
      description: The error codes of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.FQIN
      description: The FQIN of the email message (e.g., example.com-10000_instance1).
      type: String
    - contextPath: Proofpoint.SmartSearch.SMIME_Recipients
      description: The SMIME recipients of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Agent
      description: The agent host of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Subject
      description: The subject of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Final_Rule
      description: The final rule of the email message (e.g., access.system).
      type: String
    - contextPath: Proofpoint.SmartSearch.Suborg
      description: The sub-organization of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.SMIME_Recipients_Signed
      description: The SMIME signed recipients  for the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Message_Encrypted
      description: The encrypted email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Message_Split
      description: The split of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Disposition_SmtpProfile
      description: The disposition SMTP profile of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sendmail_To
      description: The send to address in the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sendmail_Stat
      description: The send email status of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.SID
      description: The SID of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Message_ID
      description: The ID of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Final_Action
      description: The final action of the email message (e.g., accept).
      type: String
    - contextPath: Proofpoint.SmartSearch.Sender
      description: The sender of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Sendmail_To_Stat
      description: The send mail to status of the email message.
      type: String
    - contextPath: Proofpoint.SmartSearch.Message_Size
      description: The size of the email message.
      type: String
  - arguments:
    - description: 'Envelope message sender equals, starts with, ends with, or is in a domain such as "bar.com". At least one of the following arguments must be specified: sender, recipient, subject.'
      name: sender
    - description: 'Envelope message recipient equals, starts with, ends with, or is in a domain such as "bar.com". At least one of the following arguments must be specified: sender, recipient, subject.'
      name: recipient
    - description: 'Message subject starts with, ends with, or contains. At least one of the following arguments must be specified: sender, recipient, subject.'
      name: subject
    - defaultValue: 24 hours
      description: Time from when the search should begin. Can be either free text (<number> <time unit>, e.g., 12 hours, 7 days) or ISO-8601 (YYYY-MM-DDThh:mm:ssZ, e.g., 2020-01-25T10:00:00Z).
      name: start_time
    - description: Time of when the search should end. Can be either free text (<number> <time unit>, e.g., 12 hours, 7 days) or ISO-8601 (YYYY-MM-DDThh:mm:ssZ, e.g., 2020-01-25T10:00:00Z).
      name: end_time
    - defaultValue: Quarantine
      description: Quarantine folder name.
      name: folder_name
    - description: Message Global Unique Identifier (generated by PPS) to retrieve raw data for a message. If it is specified and a message is found, the message’s raw data is returned.
      name: guid
    description: Search for quarantined messages.
    name: proofpoint-pps-quarantine-messages-list
    outputs:
    - contextPath: Proofpoint.QuarantinedMessage.processingserver
      description: The processing server of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.date
      description: The date of the quarantined message.
      type: Date
    - contextPath: Proofpoint.QuarantinedMessage.subject
      description: The subject of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.messageid
      description: The ID of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.folder
      description: The folder of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.size
      description: The size of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.rcpts
      description: The recipients of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.from
      description: The sender of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.spamscore
      description: The spam score of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.guid
      description: The GUID of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.host_ip
      description: The host IP address of the quarantined message.
      type: String
    - contextPath: Proofpoint.QuarantinedMessage.localguid
      description: The local GUID of the quarantined message.
      type: String
  - arguments:
    - description: Name of the folder where the message is stored (e.g., HIPAA).
      name: folder_name
      required: true
    - description: Comma-separated list of message GUIDs. Format is folder_id:table_id:dbase_id (e.g., 4:2:6), or in Cloud Quarantine format is GUID (e.g., g4fsnj_sTLMk9hECaJ wmmxwP6lQkr5k7). Can be retrieved using the proofpoint-pps-quarantine-messages-list command.
      name: local_guid
      required: true
    - description: Name of the folder to move the message to. The folder must be for quarantined messages from the same type of module. For example, you cannot send deleted spam messages to a folder for deleted DLP incidents, and vice versa.
      name: deleted_folder
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to rescan the message by the DLP and Attachment Defense filtering modules. Possible values are: "true" and "false".'
      name: scan
      predefined:
      - 'true'
      - 'false'
    - description: When encryption is licensed, the Branding Template to use when an encrypted message is released. The Branding Templates are listed on the System > End User Services > Branding Templates page in the management interface (admin GUI).
      name: brand_template
    - description: The Secure Reader response profile to use when a release is used for an encrypted message.The Response Profiles are listed on the Information Protection > Encryption > Response Profiles page in the management interface (admin UI).
      name: security_policy
    description: Releases the message to the email infrastructure without further scanning. The message remains in the folder and will be moved to the `deleted_folder` if specified.
    name: proofpoint-pps-quarantine-message-release
  - arguments:
    - description: Name of the folder where the message is stored (e.g., HIPAA).
      name: folder_name
      required: true
    - description: Comma-separated list of message GUIDs. Format is folder_id:table_id:dbase_id (e.g., 4:2:6), or in Cloud Quarantine format is GUID (e.g., g4fsnj_sTLMk9hECaJ wmmxwP6lQkr5k7).
      name: local_guid
      required: true
    description: Resubmits the message to the filtering modules. The message is removed from the folder and will not be moved to any folder.
    name: proofpoint-pps-quarantine-message-resubmit
  - arguments:
    - description: Name of the folder where the message is stored (e.g., HIPAA).
      name: folder_name
      required: true
    - description: Comma-separated list of message GUIDs. Format is folder_id:table_id:dbase_id (e.g., 4:2:6), or in Cloud Quarantine format is GUID (e.g., g4fsnj_sTLMk9hECaJ wmmxwP6lQkr5k7). Can be retrieved using the proofpoint-pps-quarantine-messages-list command.
      name: local_guid
      required: true
    - description: Name of the folder to move the message to. The folder must be for quarantined messages from the same type of module. For example, you cannot send deleted spam messages to a folder for deleted DLP Incidents, and vice versa.
      name: deleted_folder
    - description: The new subject with which to overwrite the original subject for the message.
      name: subject
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to append the original subject to the string specified in the subject argument. Possible values are: "true" and "false".'
      name: append_old_subject
      predefined:
      - 'true'
      - 'false'
    - description: The envelope email address of the sender.
      name: sender
    - description: The header from email address.
      name: header_from
    - description: Comma-separate list of recipient email addresses.
      name: recipient
      required: true
    - description: |-
        New message body. (The original message is
        sent as an attachment.)
      name: comment
    description: Forwards the message to another recipient. The message remains in the folder and will be moved to the deleted_folder if specified.
    name: proofpoint-pps-quarantine-message-forward
  - arguments:
    - description: Name of the folder where the message is stored (e.g., HIPAA).
      name: folder_name
      required: true
    - description: |-
        Comma-separate list of message GUIDs. Format is folder_id:table_id:dbase_id (e.g., 4:2:6), or in Cloud Quarantine format is GUID (e.g., g4fsnj_sTLMk9hECaJ
        wmmxwP6lQkr5k7). Can be retrieved using the proofpoint-pps-quarantine-messages-list command.
      name: local_guid
      required: true
    - description: Name of the folder to move the email message to (e.g., PCI).The folder for moved messages must be for quarantined messages from the same type of module. For example, you cannot move spam messages to a folder for DLP incidents, and vice versa.
      name: target_folder
      required: true
    description: Moves the message to the specified target folder.
    name: proofpoint-pps-quarantine-message-move
  - arguments:
    - description: Name of the folder where the message is stored (e.g., HIPAA).
      name: folder_name
      required: true
    - description: |-
        Comma-separate list of message GUIDs. Format is folder_id:table_id:dbase_id (e.g., 4:2:6), or in Cloud Quarantine format is GUID (e.g., g4fsnj_sTLMk9hECaJ
        wmmxwP6lQkr5k7). Can be retrieved using the proofpoint-pps-quarantine-messages-list command.
      name: local_guid
      required: true
    - description: Name of the folder to move the message to. The folder must be for quarantined messages from the same type of module. For example, you cannot send deleted spam messages to a folder for deleted DLP Incidents, and vice versa.
      name: deleted_folder
    description: Deletes the message from the quarantine folder. The message is removed from its folder and moved to the deleted_folder if specified.
    name: proofpoint-pps-quarantine-message-delete
  - arguments:
    - description: Global unique ID of the email message (e.g., g4fsnj_sTLMk9hECaJwmmxwP6lQkr5k7). Can be retrieved using the proofpoint-pps-quarantine-messages-list command.
      name: guid
      required: true
    description: Downloads a quarantine email message's raw data.
    name: proofpoint-pps-quarantine-message-download
  - arguments:
    - description: Email address of the user.
      name: email
    - description: UID of the user.
      name: uid
    description: Gets the end user resource with the specified email address or UID.
    name: proofpoint-pps-get-user
    outputs:
    - contextPath: Proofpoint.User.alias
      description: List of aliases for the enduser.
    - contextPath: Proofpoint.User.attributes
      description: All attributes for this user profile. The value of these attributes is calculated based on the Organization, Sub-Org/Group membership and Profile settings. For a description of these attributes, see the table at the end of this document.
    - contextPath: Proofpoint.User.blocklist
      description: List of all block list entries for the enduser.
    - contextPath: Proofpoint.User.created
      description: Timestamp when profile was created (in UTC).
    - contextPath: Proofpoint.User.creationsource
      description: Source for the profile creation (see the table below).
    - contextPath: Proofpoint.User.email
      description: Primary email address of the enduser.
    - contextPath: Proofpoint.User.firstname
      description: First name of enduser.
    - contextPath: Proofpoint.User.groups
      description: List of all the groups to which the user belongs.
    - contextPath: Proofpoint.User.lastmodified
      description: Timestamp when profile changes were made (in UTC).
    - contextPath: Proofpoint.User.lastname
      description: Last name of enduser.
    - contextPath: Proofpoint.User.lastpasswordchange
      description: Timestamp for the last password change.
    - contextPath: Proofpoint.User.lastsignon
      description: Timestamp for the last login by the end user.
    - contextPath: Proofpoint.User.safelist
      description: List of all safe list entries for the enduser.
    - contextPath: Proofpoint.User.suborg
      description: Defines the sub-organization to which this user profile belongs.
    - contextPath: Proofpoint.User.type
      description: 0=User 1=Mailing List.
    - contextPath: Proofpoint.User.uid
      description: uid of the user.
  - arguments:
    - description: Email address of the user.
      name: email
      required: true
    - description: Request fields in JSON string format (e.g., firstname, lastname, addgroup).
      name: fields
    - description: Attributes in JSON string format.
      name: attributes
    description: Creates a new end user resource with the specified email address.
    name: proofpoint-pps-create-user
    outputs:
    - contextPath: Proofpoint.User.alias
      description: List of aliases for the enduser.
    - contextPath: Proofpoint.User.attributes
      description: All attributes for this user profile. The value of these attributes is calculated based on the Organization, Sub-Org/Group membership and Profile settings. For a description of these attributes, see the table at the end of this document.
    - contextPath: Proofpoint.User.blocklist
      description: List of all block list entries for the enduser.
    - contextPath: Proofpoint.User.created
      description: Timestamp when profile was created (in UTC).
    - contextPath: Proofpoint.User.creationsource
      description: Source for the profile creation (see the table below).
    - contextPath: Proofpoint.User.email
      description: Primary email address of the enduser.
    - contextPath: Proofpoint.User.firstname
      description: First name of enduser.
    - contextPath: Proofpoint.User.groups
      description: List of all the groups to which the user belongs.
    - contextPath: Proofpoint.User.lastmodified
      description: Timestamp when profile changes were made (in UTC).
    - contextPath: Proofpoint.User.lastname
      description: Last name of enduser.
    - contextPath: Proofpoint.User.lastpasswordchange
      description: Timestamp for the last password change.
    - contextPath: Proofpoint.User.lastsignon
      description: Timestamp for the last login by the end user.
    - contextPath: Proofpoint.User.safelist
      description: List of all safe list entries for the enduser.
    - contextPath: Proofpoint.User.suborg
      description: Defines the sub-organization to which this user profile belongs.
    - contextPath: Proofpoint.User.type
      description: 0=User 1=Mailing List.
    - contextPath: Proofpoint.User.uid
      description: uid of the user.
  - arguments:
    - description: Email address of the user.
      name: email
    - description: UID of the user.
      name: UID
    - description: Request fields in JSON string format (e.g., firstname, lastname, addgroup).
      name: fields
    - description: Attributes in JSON string format.
      name: attributes
    description: Modifies a user profile.
    name: proofpoint-pps-modify-user
    outputs:
    - contextPath: Proofpoint.User.alias
      description: List of aliases for the enduser.
    - contextPath: Proofpoint.User.attributes
      description: All attributes for this user profile. The value of these attributes is calculated based on the Organization, Sub-Org/Group membership and Profile settings. For a description of these attributes, see the table at the end of this document.
    - contextPath: Proofpoint.User.blocklist
      description: List of all block list entries for the enduser.
    - contextPath: Proofpoint.User.created
      description: Timestamp when profile was created (in UTC).
    - contextPath: Proofpoint.User.creationsource
      description: Source for the profile creation (see the table below).
    - contextPath: Proofpoint.User.email
      description: Primary email address of the enduser.
    - contextPath: Proofpoint.User.firstname
      description: First name of enduser.
    - contextPath: Proofpoint.User.groups
      description: List of all the groups to which the user belongs.
    - contextPath: Proofpoint.User.lastmodified
      description: Timestamp when profile changes were made (in UTC).
    - contextPath: Proofpoint.User.lastname
      description: Last name of enduser.
    - contextPath: Proofpoint.User.lastpasswordchange
      description: Timestamp for the last password change.
    - contextPath: Proofpoint.User.lastsignon
      description: Timestamp for the last login by the end user.
    - contextPath: Proofpoint.User.safelist
      description: List of all safe list entries for the enduser.
    - contextPath: Proofpoint.User.suborg
      description: Defines the sub-organization to which this user profile belongs.
    - contextPath: Proofpoint.User.type
      description: 0=User 1=Mailing List.
    - contextPath: Proofpoint.User.uid
      description: uid of the user.
  - arguments:
    - description: Email address of the user.
      name: email
    - description: UID of the user.
      name: uid
    description: Delete a user profile.
    name: proofpoint-pps-delete-user
  dockerimage: demisto/python3:3.12.13.10399583
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- No test
fromversion: 5.0.0