Skip to main content

Proofpoint TAP Source

icon

The Proofpoint TAP Source provides a secure endpoint to receive data from the Proofpoint TAP SIEM API. It securely stores the required authentication, scheduling, and state tracking information.

The Proofpoint integration supports the following four event types:

  • Messages Permitted
  • Messages Blocked
  • Clicks Permitted
  • Clicks Blocked
note

This source is available in the Fed deployment.

The maximum data retention period for Proofpoint TAP is 7 days, as mentioned in their documentation. The integration will only be able to fetch a maximum of the last 7 days data. So there is a chance of data loss if the C2C stops functioning for more than a 7-day time interval.

Data collected

Polling IntervalData
300 secondsClicks
300 secondsMessages

Setup

Vendor configuration

The integration must be configured with a service credential (Service Principal) and API secret key.

Copy log options

There are two options to be aware of, Copy logs for each recipient and Copy logs for each MessagePart. With both options enabled, the integration creates and ingests four total events, for one original event.

Copy logs for each recipient

If this is enabled, the integration will create a duplicate log, one for each recipient listed in the recipients section of a message. For example, with the following event:

{
"GUID": "c26dbea0-80d5-463b-b93c-4e8b708219ce",
"QID": "r2FNwRHF004109",
"ccAddresses": [
"bruce.wayne@university-of-education.zz"
],
"clusterId": "pharmtech_hosted",
"completelyRewritten": "true",
"fromAddress": "badguy@evil.zz",
"headerCC": "\"Bruce Wayne\" <bruce.wayne@university-of-education.zz>",
"headerFrom": "\"A. Badguy\" <badguy@evil.zz>",
"headerReplyTo": null,
"headerTo": "\"Clark Kent\" <clark.kent@pharmtech.zz>; \"Diana Prince\" <diana.prince@pharmtech.zz>",
"impostorScore": 0,
"malwareScore": 100,
"messageID": "20160624211145.62086.mail@evil.zz",
"messageParts": [{
"contentType": "text/plain",
"disposition": "inline",
"filename": "text.txt",
"md5": "008c5926ca861023c1d2a36653fd88e2",
"oContentType": "text/plain",
"sandboxStatus": "unsupported",
"sha256": "85738f8f9a7f1b04b5329c590ebcb9e425925c6d0984089c43a022de4f19c281"
},
{
"contentType": "application/pdf",
"disposition": "attached",
"filename": "Invoice for Pharmtech.pdf",
"md5": "5873c7d37608e0d49bcaa6f32b6c731f",
"oContentType": "application/pdf",
"sandboxStatus": "threat",
"sha256": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca"
}
],
"messageTime": "2016-06-24T21:18:38.000Z",
"modulesRun": [
"pdr",
"sandbox",
"spam",
"urldefense"
],
"phishScore": 46,
"policyRoutes": [
"default_inbound",
"executives"
],
"quarantineFolder": "Attachment Defense",
"quarantineRule": "module.sandbox.threat",
"recipient": [
"clark.kent@pharmtech.zz",
"diana.prince@pharmtech.zz"
],
"replyToAddress": null,
"sender": "e99d7ed5580193f36a51f597bc2c0210@evil.zz",
"senderIP": "192.0.2.255",
"spamScore": 4,
"subject": "Please find a totally safe invoice attached.",
"threatsInfoMap": [{
"campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
"classification": "MALWARE",
"threat": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca",
"threatId": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca",
"threatStatus": "active",
"threatTime": "2016-06-24T21:18:38.000Z",
"threatType": "ATTACHMENT",
"threatUrl": "https://threatinsight.proofpoint.com/#/73aa0499-dfc8-75eb-1de8-a471b24a2e75/threat/u/2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca"
},
{
"campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
"classification": "MALWARE",
"threat": "badsite.zz",
"threatId": "3ba97fc852c66a7ba761450edfdfb9f4ffab74715b591294f78b5e37a76481aa",
"threatTime": "2016-06-24T21:18:07.000Z",
"threatType": "URL",
"threatUrl": "https://threatinsight.proofpoint.com/#/73aa0499-dfc8-75eb-1de8-a471b24a2e75/threat/u/3ba97fc852c66a7ba761450edfdfb9f4ffab74715b591294f78b5e37a76481aa"
}
],
"toAddresses": [
"clark.kent@pharmtech.zz",
"diana.prince@pharmtech.zz"
],
"xmailer": "Spambot v2.5"
}

Two total event logs would be created, one with the recipient field of clark.kent@pharmtech.zz and one with the recipient field of diana.prince@pharmtech.zz. If this option is disabled, the above event will be ingested without any changes.

Copy logs for each MessagePart

This will create duplicate logs, one for each value within MessageParts. Take the above message. If enabled, the integration will log two events. One with MessageParts of:

{
"contentType": "text/plain",
"disposition": "inline",
"filename": "text.txt",
"md5": "008c5926ca861023c1d2a36653fd88e2",
"oContentType": "text/plain",
"sandboxStatus": "unsupported",
"sha256": "85738f8f9a7f1b04b5329c590ebcb9e425925c6d0984089c43a022de4f19c281"
}

The other with MessageParts of:

{
"contentType": "application/pdf",
"disposition": "attached",
"filename": "Invoice for Pharmtech.pdf",
"md5": "5873c7d37608e0d49bcaa6f32b6c731f",
"oContentType": "application/pdf",
"sandboxStatus": "threat",
"sha256": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca"
}

If this option is disabled, the above event will be ingested with no change.

info

With both options enabled above, the integration would create and ingest four total events, for one original event.

Source configuration

When you create a Proofpoint TAP Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see Configure a Hosted Collector.

To configure a Proofpoint TAP Source:

  1. In Sumo Logic, select Manage Data > Collection > Collection
  2. On the Collectors page, click Add Source next to a Hosted Collector.
  3. Search for and select Proofpoint TAP.
  4. Enter a Name for the Source. The description is optional.
  5. (Optional) For Source Category, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called _sourceCategory.
  6. Forward to SIEM. Check the checkbox to forward your data to Cloud SIEM.
  7. (Optional) Fields. Click the +Add Field link to define the fields you want to associate, each field needs a name (key) and value.
    • green check circle.png A green circle with a check mark is shown when the field exists in the Fields table schema.
    • orange exclamation point.png An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
  8. Proofpoint Domain. Provide a Proofpoint endpoint if different from the default, tap-api-v2.proofpoint.com.
  9. API Secret. Provide the Proofpoint API Secret for authenticating collection requests.
  10. Service Principal. Provide the Proofpoint Service Principal for authenticating collection requests.
  11. Select from the options Copy logs for each recipient and Copy logs for each MessagePart. With both options enabled, the integration creates and ingests four total events, for one original event. See copy options for details.
  12. (Optional) The Polling Interval is set for 300 seconds by default, you can adjust it based on your needs.
  13. When you are finished configuring the Source, click Submit.

Metadata fields

FieldValueDescription
_siemProductTAPSet when Forward To SIEM is checked.
_siemVendorProofpointSet when Forward To SIEM is checked.
_siemFormatJSONSet when Forward To SIEM is checked.
_siemEventIDCLICK_BLOCKED, CLICK_PERMITTED, CLICK_PERMITTED, or MESSAGE_DELIVEREDThe SIEM event ID is set to the type of message ingested.

JSON schema

Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See how to use JSON to configure Sources for details. 

ParameterTypeValueRequiredDescription
schemaRefJSON Object{"type":"Proofpoint"}YesDefine the specific schema type.
sourceTypeString"Universal"YesType of source.
configJSON ObjectConfiguration objectYesSource type specific values.

Configuration Object

ParameterTypeRequiredDefaultDescriptionExample
nameStringYesnullType a desired name of the source. The name must be unique per Collector. This value is assigned to the metadata field _source."mySource"
descriptionStringNonullType a description of the source."Testing source"
categoryStringNonullType a category of the source. This value is assigned to the metadata field _sourceCategory. See best practices for details."mySource/test"
fieldsJSON ObjectNonullJSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field _siemForward to enable forwarding to SIEM.{"_siemForward": false, "fieldA": "valueA"}
domainStringYesProvide a Proofpoint endpoint if different from the default, tap-api-v2.proofpoint.com.
api_secretStringYesnullProvide the Proofpoint API Secret for authenticating collection requests.
service_principalStringYesnullProvide the Proofpoint Service Principal for authenticating collection requests.
supported_eventsJSON ObjectYesnullThe events to collect, options are clicks and messages.
split_recipientsBooleanNotrueSet to true to copy logs for each recipient.
split_message_partsBooleanNofalseSet to true to copy logs for each MessagePart.
pollingIntervalIntegerNo300This sets how often the Source checks for new data.

JSON example

{
"api.version":"v1",
"source":{
"schemaRef":{
"type":"Proofpoint"
},
"config":{
"name":"Proofpoint",
"description":"East field",
"domain":"tap-api-v2.proofpoint.com",
"api_secret":"********",
"service_principal":"********",
"split_recipients":true,
"split_message_parts":false,
"fields":{
"_siemForward":false
},
"category":"eastTeamF",
"pollingInterval":300
},
"sourceType":"Universal"
}
}

Download example

Terraform example

resource "sumologic_cloud_to_cloud_source" "proofpoint_tap_source" {
collector_id = sumologic_collector.collector.id
schema_ref = {
type = "Proofpoint"
}
config = jsonencode({
"name":"Proofpoint",
"description":"East field",
"domain":"tap-api-v2.proofpoint.com",
"api_secret":"********",
"service_principal":"********",
"split_recipients":true,
"split_message_parts":false,
"fields":{
"_siemForward":false
},
"category":"eastTeamF",
"pollingInterval":300
})
}
resource "sumologic_collector" "collector" {
name = "my-collector"
description = "Just testing this"
}

Download example

FAQ

info

Click here for more information about Cloud-to-Cloud sources.

Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.