category: Network Security
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: Proofpoint Threat Response
  version: -1
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key
  hiddenusername: true
  section: Connect
  required: false
- display: API Key
  name: apikey
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: 'false'
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '12 hours'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  additionalinfo: The time range for the initial data fetch. If timeout errors occur, consider changing this value.
  section: Collect
  required: false
- defaultvalue: '50'
  display: Fetch limit - maximum number of incidents per fetch
  name: fetch_limit
  type: 0
  section: Collect
  required: false
- display: Fetch delta - The delta time in each batch. e.g. 1 hour, 3 minutes.
  name: fetch_delta
  type: 0
  defaultvalue: 6 hours
  additionalinfo: The time range between create_after and created_before that is sent to the API when fetching older incidents. If timeout errors occur, consider changing this value.
  section: Collect
  required: false
- display: Fetch incident with specific states.
  name: states
  type: 16
  section: Collect
  advanced: false
  required: false
  options:
  - new
  - open
  - assigned
  - closed
  - ignored
  additionalinfo: >
    When fetch is enable you must provide this argument. Possible values are: new, open, assigned, closed or ignored.
- display: Fetch incidents with specific event sources. Can be a list of comma separated values.
  name: event_sources
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch incidents with specific 'Abuse Disposition' values. Can be a list of comma separated values.
  name: abuse_disposition
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: You can find this value by navigating to Sources -> JSON event source -> POST URL.
  display: POST URL of the JSON alert source.
  name: post_url_id
  type: 0
  section: Collect
  advanced: true
  required: false
description: Use the Proofpoint Threat Response integration to orchestrate and automate incident response.
display: Proofpoint Threat Response
name: Proofpoint Threat Response
script:
  commands:
  - arguments:
    - description: The ID of the list.
      name: list-id
      required: true
    description: Gets items for the specified list.
    name: proofpoint-tr-get-list
  - arguments:
    - description: The list to add a member to.
      name: list-id
      required: true
    - description: 'A comma-separated list of indicator values. Can be IP addresses, URLs, domains, or file hashes. For example: "192.168.1.1,192.168.1.2".'
      isArray: true
      name: indicator
      required: true
    - description: A comment about the member.
      name: comment
    - description: The member expiration.
      name: expiration
    description: Adds a member to the specified list.
    execution: true
    name: proofpoint-tr-add-to-list
  - arguments:
    - description: A comma-separated list of IP addresses to add to block list.
      isArray: true
      name: ip
      required: true
    - description: 'The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the IP block list.
      name: blacklist_ip
      required: true
    description: Adds the supplied IP addresses to the specified IP block list.
    execution: true
    name: proofpoint-tr-block-ip
  - arguments:
    - description: A comma-separated list of domains to add to the block list.
      isArray: true
      name: domain
      required: true
    - description: 'The date and time the supplied IP addresses should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the domain block list.
      name: blacklist_domain
      required: true
    description: Adds the supplied domains to the specified block list.
    name: proofpoint-tr-block-domain
  - arguments:
    - description: The ID of the list in which to search.
      name: list-id
      required: true
    - description: The filter for the indicator search. For example, "1.1" will return [1.1.1.1, 22.22.1.1, 1.1.22.22].
      name: filter
      required: true
    description: Returns indicators from the specified list, according to the defined filter.
    name: proofpoint-tr-search-indicator
  - arguments:
    - description: The ID of the list from which to delete indicators.
      name: list-id
      required: true
    - description: 'The indicator value to delete from the list. Can be an IP address, URL, domain, or file hash. For example: "demisto.com".'
      name: indicator
      required: true
    description: Deletes an indicator from the specified list.
    name: proofpoint-tr-delete-indicator
  - arguments:
    - description: A comma-separated list of URLs to add to the URL block list.
      isArray: true
      name: url
      required: true
    - description: 'The date and time the supplied URLs should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the URL block list.
      name: blacklist_url
      required: true
    description: Adds the supplied URLs to the specified URL block list.
    name: proofpoint-tr-block-url
  - arguments:
    - description: A comma-separated list of file hashes to add to the file hash block list.
      isArray: true
      name: hash
      required: true
    - description: 'The date and time the supplied file hashes should be removed from the block list, in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: expiration
    - description: The ID of the hash block list.
      name: blacklist_hash
      required: true
    description: Adds the supplied file hashes to the specified file hash block list.
    name: proofpoint-tr-block-hash
  - arguments:
    - auto: PREDEFINED
      description: The state of the incidents to retrieve.
      name: state
      predefined:
      - new
      - open
      - assigned
      - closed
      - ignored
    - description: 'Retrieve incidents that were created after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: created_after
      predefined:
      - ''
    - description: 'Retrieve incidents that were created before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: created_before
    - description: 'Retrieve incidents that were closed after this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: closed_after
    - description: 'Retrieve incidents that were closed before this date, in ISO 8601 format (UTC). Example: 2020-02-22 or 2020-02-22T00:00:00Z.'
      name: closed_before
    - auto: PREDEFINED
      description: If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.
      name: expand_events
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '50'
      description: The maximum number of incidents to return.
      name: limit
      required: true
    description: Retrieves all incident metadata from Threat Response by specifying filter criteria such as the state of the incident or time of closure.
    name: proofpoint-tr-list-incidents
    outputs:
    - contextPath: ProofPointTRAP.Incident.id
      description: The incident ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.summary
      description: The summary of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.score
      description: The score of the incident from Proofpoint.
      type: Number
    - contextPath: ProofPointTRAP.Incident.state
      description: The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
      type: String
    - contextPath: ProofPointTRAP.Incident.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.Incident.updated_at
      description: The date the incident was last updated.
      type: Date
    - contextPath: ProofPointTRAP.Incident.event_count
      description: The number of events attached to the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.false_positive_count
      description: The number of false positive events in the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.event_sources
      description: The sources of the events.
      type: String
    - contextPath: ProofPointTRAP.Incident.assignee
      description: The user assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.team
      description: The team assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.attacker
      description: The host attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.forensics
      description: The host forensics.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Severity
      description: The severity of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Abuse_disposition
      description: The abuse disposition of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Attack_vector
      description: The attack vector of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Classification
      description: The classification of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.id
      description: The event ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.category
      description: The event category.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.alertType
      description: The alert type of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.severity
      description: The severity of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.source
      description: The source of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.state
      description: The state of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.attackDirection
      description: The attack direction of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.received
      description: The time the incident was received.
      type: Date
    - contextPath: ProofPointTRAP.Incident.events.emails.sender
      description: The sender of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.recipient
      description: The recipient of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_Id
      description: The message ID of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_delivery_time
      description: The delivery time of the message.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.attackers.location
      description: The location of the attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.falsePositive
      description: Whether this incident is a false positive.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.events.threatname
      description: The threat name.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.description
      description: The description of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.malwareName
      description: The malware name.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.alertSource
      description: The alert source.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.startTime
      description: The start time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.endTime
      description: The end time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.status
      description: The status of the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipientType
      description: The recipient type.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipient
      description: The recipient email address.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.messageId
      description: The message ID.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.isRead
      description: Whether the message has been read.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.quarantine_results.wasUndone
      description: Whether the message was undone.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.details
      description: The details about the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.successful_quarantines
      description: The number of successful quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.failed_quarantines
      description: The number of failed quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.pending_quarantines
      description: The number of pending quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.emails.body
      description: The body of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.body_type
      description: The format of the body.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.headers
      description: The email headers.
      type: Unknown
    - contextPath: ProofPointTRAP.Incident.events.emails.urls
      description: The list of URLs from the email.
      type: Unknown
    - contextPath: ProofPoint.Incident.event_ids
      description: The list of IDs attached to the incident.
      type: Unknown
  - arguments:
    - default: true
      description: The ID value of the incident to retrieve (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: If false, will return an array of event IDs instead of full event objects. This will significantly speed up the response time of the API for incidents with large numbers of alerts.
      name: expand_events
      predefined:
      - 'true'
      - 'false'
    description: Retrieves incident metadata from Threat Response.
    name: proofpoint-tr-get-incident
    outputs:
    - contextPath: ProofPointTRAP.Incident.id
      description: The incident ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.summary
      description: The summary of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.score
      description: The score of the incident from Proofpoint.
      type: Number
    - contextPath: ProofPointTRAP.Incident.state
      description: The state of the incident. Can be - Open, Closed, New, Assigned, Ignored.
      type: String
    - contextPath: ProofPointTRAP.Incident.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.Incident.updated_at
      description: The date the incident was last updated.
      type: Date
    - contextPath: ProofPointTRAP.Incident.event_count
      description: The number of events attached to the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.false_positive_count
      description: The number of false positive events in the incident.
      type: Number
    - contextPath: ProofPointTRAP.Incident.event_sources
      description: The sources of the events.
      type: String
    - contextPath: ProofPointTRAP.Incident.assignee
      description: The user assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.team
      description: The team assigned to the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.attacker
      description: The host attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.hosts.forensics
      description: The host forensics.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Severity
      description: The severity of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Abuse_disposition
      description: The abuse disposition of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Attack_vector
      description: The attack vector of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.incident_field_values.Classification
      description: The classification of the incident.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.id
      description: The event ID.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.category
      description: The event category.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.alertType
      description: The alert type of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.severity
      description: The severity of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.source
      description: The source of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.state
      description: The state of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.attackDirection
      description: The attack direction of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.received
      description: The date the incident was received.
      type: Date
    - contextPath: ProofPointTRAP.Incident.events.emails.sender
      description: The sender of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.recipient
      description: The recipient of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_Id
      description: The message ID of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.message_delivery_time
      description: The time the message was delivered.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.attackers.location
      description: The location of the attacker.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.falsePositive
      description: Whether this incident is a false positive.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.events.threatname
      description: The threat name.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.description
      description: The description of the event.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.malwareName
      description: The malware name.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.alertSource
      description: The alert source.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.startTime
      description: The start time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.endTime
      description: The end time of the result.
      type: Date
    - contextPath: ProofPointTRAP.Incident.quarantine_results.status
      description: The status of the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipientType
      description: The recipient type.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.recipient
      description: The recipient email address.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.messageId
      description: The message ID.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.isRead
      description: Whether the message has been read.
      type: Boolean
    - contextPath: ProofPointTRAP.Incident.quarantine_results.wasUndone
      description: Whether the message was undone.
      type: String
    - contextPath: ProofPointTRAP.Incident.quarantine_results.details
      description: The details about the result.
      type: String
    - contextPath: ProofPointTRAP.Incident.successful_quarantines
      description: The number of successful quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.failed_quarantines
      description: The number of failed quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.pending_quarantines
      description: The number of pending quarantines.
      type: Number
    - contextPath: ProofPointTRAP.Incident.events.emails.body
      description: The body of the email.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.body_type
      description: The format of the body.
      type: String
    - contextPath: ProofPointTRAP.Incident.events.emails.headers
      description: The email headers.
      type: Unknown
    - contextPath: ProofPointTRAP.Incident.events.emails.urls
      description: The list of URLs from the email.
      type: Unknown
    - contextPath: ProofPoint.Incident.event_ids
      description: The list of IDs attached to the incident.
      type: Unknown
  - arguments:
    - description: The ID value of the incident to add the comment to (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - description: 'The details of the comments. '
      name: details
      required: true
    - description: The summary of the comments.
      name: comments
      required: true
    description: Adds comments to an existing Threat Response incident, by incident ID.
    name: proofpoint-tr-update-incident-comment
    outputs:
    - contextPath: ProofPointTRAP.IncidentComment.id
      description: The ID of the comment.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.incident_id
      description: The ID of the incident.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.response_id
      description: The ID of the response.
      type: Number
    - contextPath: ProofPointTRAP.IncidentComment.user_id
      description: The ID of the user.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.history_type
      description: The history type.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.state_from
      description: The state from of the incident.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.state_to
      description: The state to of the incident.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.summary
      description: The summary of the comments.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.detail
      description: The details of the comment.
      type: String
    - contextPath: ProofPointTRAP.IncidentComment.created_at
      description: The date the incident was created.
      type: Date
    - contextPath: ProofPointTRAP.IncidentComment.updated_at
      description: The date the incident was last updated.
      type: Date
  - arguments:
    - description: The ID value of the incident to add the user to (e.g. for incident INC-4000, the input for this argument should be 4000).
      name: incident_id
      required: true
    - description: The list of targets to add to the incident.
      isArray: true
      name: targets
      required: true
    - description: The list of attackers to add to the incident.
      isArray: true
      name: attackers
      required: true
    description: Assigns a user to an incident as a target or attacker.
    name: proofpoint-tr-add-user-to-incident
  - arguments:
    - description: The incident ID to close.
      name: incident_id
    - description: The incident closure details.
      name: details
    - description: The incident closure summary.
      name: summary
    description: Close a specified incident.
    name: proofpoint-tr-close-incident
  - arguments:
    - description: POST URL of the JSON alert source. You can find it by navigating to Sources -> JSON event source -> POST URL.
      name: post_url_id
    - auto: PREDEFINED
      defaultValue: '2.0'
      description: The Threat Response JSON version.
      name: json_version
      predefined:
      - '2.0'
      - '1.0'
      required: true
    - description: 'An attacker object in JSON format : "{"attacker" : {...}}". The attacker object must contain one of ["ip_address", mac_address", "host_name", "url", "user"] keys. You can also add the "port" key to the object. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: attacker
    - auto: PREDEFINED
      description: The alert classification shown as "Alert Type" in the TRAP UI.
      name: classification
      predefined:
      - malware
      - policy-violation
      - vulnerability
      - network
      - spam
      - phish
      - command-and-control
      - data-match
      - authentication
      - system-behavior
      - impostor
      - reported-abuse
      - unknown
    - description: 'The Command and Control host information in JSON format : "{"cnc_hosts": [{"host" : "-", "port": "-"}, ...]}". Note: Every item of the "cnc_hosts" list is in JSON format. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: cnc_hosts
    - description: 'The threat detection tool such as Firewall and IPS/IDS systems (in the format: "{"detector" : {...}}"), which generated the original alert. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: detector
    - description: 'The email metadata related to the alert, in JSON format: "{"email": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: email
    - description: 'The forensics host information in JSON format : "{"forensics_hosts": [{"host" : "-", "port": "-"}...]}". Note: Every item of the "forensics_hosts" list is in JSON format. For more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: forensics_hosts
    - auto: PREDEFINED
      description: The attribute to link alerts to.
      name: link_attribute
      predefined:
      - target_ip_address
      - target_hostname
      - target_machine_name
      - target_user
      - target_mac_address
      - attacker_ip_address
      - attacker_hostname
      - attacker_machine_name
      - attacker_user
      - attacker_mac_address
      - email_recipient
      - email_sender
      - email_subject
      - message_id
      - threat_filename
      - threat_filehash
    - auto: PREDEFINED
      description: The severity of the alert.
      name: severity
      predefined:
      - info
      - minor
      - moderate
      - major
      - critical
      - Informational
      - Low
      - Medium
      - High
      - Critical
    - description: The alert summary. This argument will populate the Alert Details field.
      name: summary
    - description: 'The target host information in JSON format : "{"target": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: target
    - description: 'The threat information in JSON format: "{"threat_info": {...}}". To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: threat_info
    - description: 'A JSON object for collecting custom name-value pairs as part of the JSON alert sent to Threat Response, in the format: "{"custom_fields": {..}}". Although there is no limit to the number of custom fields, Proofpoint recommends keeping it to 10 or fewer fields. To see all relevant JSON fields and for more information, see Proofpoint TRAP documentation under "JSON Alert Source 2.0".'
      name: custom_fields
    description: Ingest an alert into Threat Response.
    name: proofpoint-tr-ingest-alert
  - arguments:
    - description: The message ID of the email.
      name: message_id
      required: true
    - description: The recipient of the email.
      name: recipient
      required: true
    - description: 'The reception time of the email in the format YYYY-MM-DDTHH:MM:SSZ. For example: 2020-02-02T19:00:00Z.'
      name: time
      required: true
    - name: limit_quarantine_occurred_time
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
      description: Whether or not to limit the results to include only quarantines that occurred within a limited time after alert creation.
      defaultValue: "True"
    - name: quarantine_limit
      description: Only used if 'limit_quarantine_occurred_time' argument is set to true. Sets a limit on the quarantines retrieved to include only those where the time difference between alert time and quarantined time is less than the number of seconds specified. The time is in seconds.
      defaultValue: "120"
    - name: fetch_delta
      defaultValue: '6'
      description: The time frame (in hours) used to identify the size of batches when retrieving the messages. e.g., 12.
    - name: check_exact_reception_time
      defaultValue: 'true'
      description: If true, the command checks for quarantined emails with the exact reception time of the email. If false, the verification of the quarantined email only uses the message ID and the recipient email.
    outputs:
    - contextPath: ProofPointTRAP.Quarantine
      description: Results of the email quarantine operation.
      type: String
    description: Verify if an email has been quarantined.
    name: proofpoint-tr-verify-quarantine
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No test
fromversion: 5.0.0