Proofpoint Plugin for Threat Exchange

This document explains how to integrate Proofpoint with the Threat Exchange module of the Netskope Cloud Exchange platform. This integration allows for sharing of URLs and file hashes with Netskope that have been identified by Proofpoint.

Prerequisites

Workflow

Configure the Proofpoint Plugin

1. In Cloud Exchange, go to Settings and click Plugins.
2. Search for and select the Proofpoint plugin box to open the Plugin creation pages.

   

3. Enter a Configuration Name.
4. Adjust the Sync Interval to appropriate value: Suggested is 5+ minutes.

   

5. Click Next.
6. Enter your Proofpoint Base URL (if it’s different from the default one).
7. Enter your Proofpoint Username and Password.
8. Enter appropriate Event Type(s) to be fetched from Proofpoint. The IoCs corresponding to selected event types will be fetched.
9. Set the Initial Range (in hours) from 1 to 12 (The maximum time into the past that can be queried is limited to 12 hours by Proofpoint. Therefore, if “Last Run” is older than 12 hours, the data older than 12 hours won’t be fetched).

   

10. Click Save.

Configure Threat Exchange Sharing for Proofpoint

1. Go to Threat Exchange and select Sharing. The Sharing page displays the existing relationships for each sharing configuration in grid view as shown below. The Sharing page also has inputs to configure new sharing from one plugin to another.

   

2. Click Add Sharing Configuration, and in the Source Configuration dropdown list, select Proofpoint.

3. Select a Business Rule, and then select Netskope for the Destination Configuration. Sharing configurations are unidirectional. data obtained from one plugin is shared with another plugin. To achieve bi- or multi-directional sharing, configure each separately.

4. Select a Target. Each plugin will have a different target or destination for the IoC.
5. Click Save.

   Note

   Sharing IoCs from Netskope to Proofpoint is not supported. Proofpoint does not accept 3rd-party intel.

   In order to validate the workflow, you must have Proofpoint indicators. Polling Intervals will be defined during plugin configuration.

Validate the Proofpoint Plugin

1. Go to Threat Exchange and select Threat IoCs.

   

2. Validate data is being shared between the two plugins. If data is not being shared between the platforms, look at the audit logs in Cloud Exchange. Select Logging and look through the logs for errors.