Integrate Proofpoint Threat Protection with Google SecOps

Integration version: 1.0

This document explains how to integrate Proofpoint Threat Protection with Google Security Operations.

Use cases

In the Google SecOps platform, the Proofpoint Threat Protectionintegration supports the following use cases:

• Automated phishing mitigation: Automatically add malicious sender email addresses and domains to the Proofpoint block list after a phishing alert is verified to prevent further delivery of similar threats across the organization.

• Accelerated incident response: Rapidly update block list entries for IP addresses and hostnames during an active investigation to ensure that newly discovered indicators of compromise (IOCs) are immediately neutralized at the email gateway.

• Proactive threat protection: Proactively query and retrieve existing allow and block list entries to ensure security policies remain up to date and consistent with current threat intelligence, reducing the organization's attack surface.

• Simplified policy management: Streamline the administration of email security policies by using playbooks to manage bulk additions or removals of trusted senders to the allow list based on approved business requests.

Before you begin

Before you configure the integration in the Google SecOps platform, verify that you have the following:

• Proofpoint Threat Protection API credentials: Ensure you have a valid client ID and client secret. These are generated within the Proofpoint administrative console

• Cluster ID: Identify the specific cluster ID associated with your Proofpoint instance. This ID is required to target the correct allow and block lists.

• Network connectivity: Verify that the Google SecOps environment can communicate with the Proofpoint Threat Protection API root endpoint. If you're using a proxy, ensure the credentials and addresses are available.

Integration parameters

The Proofpoint Threat Protectionintegration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

Add Entry to Allow List

Use the Add Entry to Allow Listaction to add an entry to the Proofpoint Threat Protection allow list.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Entry to Allow Listaction requires the following parameters:

  { 
  
 "action" 
 : 
  
 "add" 
 , 
  
 "attribute" 
 : 
  
 "" 
 , 
  
 "operator" 
 : 
  
 "" 
 , 
  
 "value" 
 : 
  
 "" 
 , 
  
 "comment" 
 : 
  
 "" 
 } 
 

Action outputs

The Add Entry to Allow Listaction provides the following outputs:

Output messages

The Add Entry to Allow Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Entry to Allow Listaction:

Add Entry to Block List

Use the Add Entry to Block Listaction to add an entry to the Proofpoint Threat Protection block list.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Entry to Block Listaction requires the following parameters:

  { 
  
 "action" 
 : 
  
 "add" 
 , 
  
 "attribute" 
 : 
  
 "" 
 , 
  
 "operator" 
 : 
  
 "" 
 , 
  
 "value" 
 : 
  
 "" 
 , 
  
 "comment" 
 : 
  
 "" 
 } 
 

Action outputs

The Add Entry to Block Listaction provides the following outputs:

Output messages

The Add Entry to Block Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Entry to Block Listaction:

Add IOC to Allow List

Use the Add IOC to Allow Listaction to add specific IOCs to the Proofpoint Threat Protection allow list.

This action doesn't run on Google SecOps entities.

Action inputs

The Add IOC to Allow Listaction requires the following parameters:

Action outputs

The Add IOC to Allow Listaction provides the following outputs:

Output messages

The Add IOC to Allow Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add IOC to Allow Listaction:

Add IOC to Block List

Use the Add IOC to Block Listaction to add specific IOCs to the Proofpoint Threat Protection block list.

This action doesn't run on Google SecOps entities.

Action inputs

The Add IOC to Block Listaction requires the following parameters:

Action outputs

The Add IOC to Block Listaction provides the following outputs:

Output messages

The Add IOC to Block Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add IOC to Block Listaction:

Get Allow List Entries

Use the Get Allow List Entriesaction to retrieve existing entries from the Proofpoint Threat Protection allow list.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Allow List Entriesaction requires the following parameters:

Action outputs

The Get Allow List Entriesaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Allow List Entriesaction:

  [ 
  
 { 
  
 "attribute" 
 : 
  
 "$from" 
 , 
  
 "operator" 
 : 
  
 "equal" 
 , 
  
 "value" 
 : 
  
 "test@example.com" 
 , 
  
 "comment" 
 : 
  
 "" 
  
 } 
 ] 
 

Output messages

The Get Allow List Entriesaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Allow List Entriesaction:

Get Block List Entries

Use the Get Block List Entriesaction to retrieve existing entries from the Proofpoint Threat Protection block list.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Block List Entriesaction requires the following parameters:

Action outputs

The Get Block List Entriesaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Block List Entriesaction:

  [ 
  
 { 
  
 "attribute" 
 : 
  
 "$from" 
 , 
  
 "operator" 
 : 
  
 "equal" 
 , 
  
 "value" 
 : 
  
 "test@example.com" 
 , 
  
 "comment" 
 : 
  
 "" 
  
 } 
 ] 
 

Output messages

The Get Block List Entriesaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Block List Entriesaction:

Ping

Use the Pingaction to test the connectivity to Proofpoint Threat Protection.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Remove Entry from Allow List

Use the Remove Entry from Allow Listaction to remove an entry from the Proofpoint Threat Protection allow list.

This action doesn't run on Google SecOps entities.

Action inputs

The Remove Entry from Allow Listaction requires the following parameters:

Action outputs

The Remove Entry from Allow Listaction provides the following outputs:

Output messages

The Remove Entry from Allow Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Remove Entry from Allow Listaction:

Remove Entry from Block List

Use the Remove Entry from Block Listaction to remove an entry from the Proofpoint Threat Protection block list.

This action doesn't run on Google SecOps entities.

Action inputs

The Remove Entry from Block Listaction requires the following parameters:

Action outputs

The Remove Entry from Block Listaction provides the following outputs:

Output messages

The Remove Entry from Block Listaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Remove Entry from Block Listaction:

Need more help? Get answers from Community members and Google SecOps professionals.