Proofpoint Targeted Attack Protection (TAP) Integration Guide๐
The following instructions are for configuring Proofpoint Targeted Attack Protection (TAP) to facilitate log ingestion into Secureworksยฎ Taegisโข XDR.
Proofpoint Requirements๐
An active Proofpoint TAP account with privileges to create service credentials is required to integrate with XDR.
Note
Not all Proofpoint subscriptions include TAP.
Taegis IP Address Ranges๐
If you have an existing firewall or API gateway IP allow list configured for this integration, or are planning to configure one, add the following XDR IP address ranges for your Taegis region.
| Taegis Region | IP Address Range |
|---|---|
| Charlie | 216.9.204.0/24 |
| Delta | 216.9.204.0/24 |
| Echo | 216.9.205.0/24 |
| Foxtrot | 216.9.206.0/24 |
| Golf | 216.9.207.0/24 |
| Hotel | 208.89.40.0/24 |
| India | 208.89.42.0/24 |
| Juliet | 208.89.41.0/24 |
| Kilo | 208.89.43.0/24 |
| Quebec | 208.89.44.0/24 |
Note
These would be the only IP ranges required for XDR integrations. If you previously configured older IP addresses, we recommend removing them after 30 days.
Data Provided from Integration๐
| Normalized Data | Out-of-the-Box Detections | Vendor-Specific Detections | |
|---|---|---|---|
| Proofpoint | HTTP |
Note
XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.
Generate Proofpoint TAP Service Credentials๐
-
Follow the instructions in the Proofpoint documentation, Generate TAP Service Credentials.
-
Note the
Service PrincipalandSecretfor the next steps.
Add Integration in XDR๐
-
From the Taegis Menu, select Integrations โ Cloud APIs.
-
Select Add an Integration from the top of the page.
Add an Integration -
From the Optimized tab, select Proofpoint.
Creating a new Proofpoint Integration -
Enter the following fields โ Obtained in the first step:
- Service Principal
- Secret
- Name โ This serves as a unique name for your integration; it can include any valid values up to 100 characters.
-
Select Done. The Cloud API Integrations page is displayed with the successfully added Proofpoint integration.
Once the above steps are completed, Proofpoint integration details are available on the Cloud APIs page. From the Taegis Menu, select Integrations โ Cloud APIs.
Advanced Search using the Query Language๐
Example Query Language Searches๐
To search for Proofpoint email events from the last 24 hours:
FROM email WHERE sensor_type = 'ProofPoint' and EARLIEST=-24h
To search for Proofpoint email events classified as phishing attempts:
FROM email WHERE sensor_type = 'ProofPoint' AND threats.classification = 'phish'
To search for Proofpoint email events that were NOT blocked:
FROM email WHERE sensor_type = 'ProofPoint' AND status != 'blocked'
Event Details๐
Data Normalized by XDR๐
Detection Details๐
