Proofpoint TAP

Proofpoint Targeted Attack Protection (TAP) helps enterprises stay ahead of attackers with an innovative approach that detects, analyses and blocks advanced threats before they reach your inbox. For detailed information refer to Proofpoint’s documentation.

Integration Method: API

Tables: Email Activity (4009), Detection Finding (2004)

This integration supports the following events.

This integration supports the following versions.

Note:

Proofpoint TAP doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service.

Prerequisites

• The user should have access to the Proofpoint TAP with administrator privileges.

• The user should have access to the DataBee console.

Configuration Overview

1. Generate service credentials on the Proofpoint TAP dashboard to authenticate to the API.

2. Add the Proofpoint TAP data feed integration in the DataBee console with the required API credentials.

   DataBee Parameter	Proofpoint TAP Parameter
   Username	Service Principal
   Password	Secret

Proofpoint TAP Configuration

1. Login to the Proofpoint TAP dashboard.

2. Navigate to Settings > CONNECTED APPLICATIONS.

   1. Click on Create New Credential.

   

3. Enter the Name for credential set.

   1. Click on the Generate button. The “Generated Service Credential” window will appear.

   

4. Copy the Service Principal and Secret for later use.

   1. Click on the Done button.

    

   Note:

   Make sure to copy and save credentials as they will not be shown again.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for Proofpoint TAP and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.
    

5. In the configuration page, confirm the following:

   • Authorization Method: Basic

   • API Base URL: this is the base URL that DataBee will interact with.

   • Username: paste the Service Principal.

   • Password: paste the Secret.

   • Event Types: preselected for all the event types that integration pulls.

   
   

6. Click Submit.

Troubleshooting Tips

• Ensure the username and password are pasted correctly. Since you cannot view the service principle and secret after the 1^st time, re-create the creds, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.