Proofpoint TAP enables advanced threat intelligence and enhanced visibility into your organization's cybersecurity environment. Torq has many pre-built steps for Proofpoint TAP, including:
Decode URLs
Decode URLs
Description: Decodes the URLs in the given list.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/url/decode
Vendor Documentation: URL Decoder API Documentation
Get Campaign Forensics
Get Campaign Forensics
Description: Returns the forensic information of the given campaign.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/forensics?&campaignId={{ .CAMPAIGN_ID }}
Vendor Documentation: Campaign Forensics API Documentation
Get Campaign Information
Get Campaign Information
Description: Returns information about the given campaign.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/campaign/{{ .CAMPAIGN_ID }}
Vendor Documentation: Campaign Information API Documentation
Get Threat Forensics
Get Threat Forensics
Description: Returns forensic details for a specific threat.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/forensics?&threatId={{ .THREAT_ID }}
Vendor Documentation: Threat Forensics API Documentation
Get Threat Summary
Get Threat Summary
Description: Returns a summary of a specified threat.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/threat/summary/{{ .THREAT_ID }}
Vendor Documentation: Threat Summary API Documentation
List Active Campaigns
List Active Campaigns
Description: Provides a list of campaigns active within a specified time range.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/campaigns/ids?&interval={{ TIME RANGE }}
Vendor Documentation: Active Campaigns API Documentation
List Blocked Message Events
List Blocked Message Events
Description: Retrieves a list of blocked messages within the specified time range.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/siem/messages/blocked?&interval={{ TIME RANGE }}
Vendor Documentation: Blocked Message Events API Documentation
List Delivered Message Events
List Delivered Message Events
Description: Retrieves events for delivered messages containing known threats.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/siem/messages/delivered?&interval={{ TIME RANGE }}
Vendor Documentation: Delivered Message Events API Documentation
List Top Clickers
List Top Clickers
Description: Identifies users frequently clicking on suspicious links within a specific timeframe.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/people/top-clickers?&window={{ DAYS_AGO }}
Vendor Documentation: Top Clickers API Documentation
List Very Attacked People
List Very Attacked People
Description: Identifies and provides metrics for the most targeted individuals in your organization.
API Call:
GET {{ .PROOFPOINT_BASE_URL }}/v2/people/vap?&window={{ DAYS_AGO }}
Vendor Documentation: Very Attacked People API Documentation
As always, you can create your own custom steps in Torq to fulfil any additional needs you may have.
Use Proofpoint Steps in a Torq Workflow
Get Your Proofpoint Details
You must be a Proofpoint account administrator to obtain the following details.
Navigate to the Threat Insight Dashboard > Settings.
Fund your Client ID and Client Secret. Copy them to a safe location for later use in Torq.
Find your Proofpoint Base URL from your Proofpoint TAP setup session.
Create a Proofpoint Step Integration in Torq
Go to Build > Integrations > Steps > Proofpoint TAP and click Add.
Give the integration a unique and meaningful name.
Enter the Proofpoint Client ID you copied earlier.
Enter the Proofpoint Client Secret you copied earlier.
Enter the Base URL you recieved earlier.
Click Add to save the integration.