Proofpoint TAP enables advanced threat intelligence and enhanced visibility into your organization's cybersecurity environment. Torq has many pre-built steps for Proofpoint TAP, including:

Decode URLs

Description: Decodes the URLs in the given list.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/url/decode
Vendor Documentation: URL Decoder API Documentation

Get Campaign Forensics

Description: Returns the forensic information of the given campaign.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/forensics?&campaignId={{ .CAMPAIGN_ID }}
Vendor Documentation: Campaign Forensics API Documentation

Get Campaign Information

Description: Returns information about the given campaign.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/campaign/{{ .CAMPAIGN_ID }}
Vendor Documentation: Campaign Information API Documentation

Get Threat Forensics

Description: Returns forensic details for a specific threat.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/forensics?&threatId={{ .THREAT_ID }}
Vendor Documentation: Threat Forensics API Documentation

Get Threat Summary

Description: Returns a summary of a specified threat.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/threat/summary/{{ .THREAT_ID }}
Vendor Documentation: Threat Summary API Documentation

List Active Campaigns

Description: Provides a list of campaigns active within a specified time range.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/campaigns/ids?&interval={{ TIME RANGE }}
Vendor Documentation: Active Campaigns API Documentation

List Blocked Message Events

Description: Retrieves a list of blocked messages within the specified time range.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/siem/messages/blocked?&interval={{ TIME RANGE }}
Vendor Documentation: Blocked Message Events API Documentation

List Delivered Message Events

Description: Retrieves events for delivered messages containing known threats.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/siem/messages/delivered?&interval={{ TIME RANGE }}
Vendor Documentation: Delivered Message Events API Documentation

List Top Clickers

Description: Identifies users frequently clicking on suspicious links within a specific timeframe.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/people/top-clickers?&window={{ DAYS_AGO }}
Vendor Documentation: Top Clickers API Documentation

List Very Attacked People

Description: Identifies and provides metrics for the most targeted individuals in your organization.
API Call: GET {{ .PROOFPOINT_BASE_URL }}/v2/people/vap?&window={{ DAYS_AGO }}
Vendor Documentation: Very Attacked People API Documentation

As always, you can create your own custom steps in Torq to fulfil any additional needs you may have.

Use Proofpoint Steps in a Torq Workflow

Get Your Proofpoint Details

You must be a Proofpoint account administrator to obtain the following details.

Navigate to the Threat Insight Dashboard > Settings.
Fund your Client ID and Client Secret. Copy them to a safe location for later use in Torq.
Find your Proofpoint Base URL from your Proofpoint TAP setup session.

Create a Proofpoint Step Integration in Torq

Go to Build > Integrations > Steps > Proofpoint TAP and click Add.
Give the integration a unique and meaningful name.
Enter the Proofpoint Client ID you copied earlier.
Enter the Proofpoint Client Secret you copied earlier.
Enter the Base URL you recieved earlier.
Click Add to save the integration.