Proofpoint Plugin for Threat Exchange

This document explains how to configure the Proofpoint v2.0.0 plugin in the Cloud Exchange platform. This plugin is used to pull IoCs of type URL, SHA256, Domain, and FQDN from the Proofpoint TAP (Targeted Attack Protection) Dashboard under Threats. The plugin supports pull retraction of indicators from Proofpoint. This plugin does not support sharing of indicators to Proofpoint platform.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A File Profile on your Netskope tenant.
• A URL List on your Netskope tenant.
• A Destination Profile on your Netskope tenant.
• A DNS Profile on your Netskope Tenant
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
• Connectivity to the Proofpoint platform.
• Connectivity to the following host: https://tap-api-v2.proofpoint.com.

Proofpoint Plugin Support

This plugin is used to pull IOCs of type URL, SHA256, Domain, and FQDN from the Proofpoint TAP (Targeted Attack Protection) Dashboard under Threats. The plugin supports pull retraction of indicators from Proofpoint. This plugin does not support sharing of indicators to Proofpoint platform.

IOC Retraction

IoC Retraction (Pull): Indicators will be fetched from Proofpoint and in the subsequent pull cycles. If some indicators are deleted from Proofpoint, they will be marked as Retracted in Cloud Exchange.

IoC Retraction (Push): Retracted indicators present on Cloud Exchange will be deleted from Proofpoint during sharing.

Mappings

Pull Mappings

{
  "clicksPermitted": [
    {
      "url": "https://example.com/malicious",
      "threatTime": "2024-01-01T12:00:00Z",
      "threatURL": "https://threatinfo.proofpoint.com/...",
      "classification": "malware"
    }
  ],
  "clicksBlocked": [
    {
      "url": "https://blocked-site.com",
      "threatTime": "2024-01-01T12:30:00Z",
      "threatURL": "https://threatinfo.proofpoint.com/...",
      "classification": "phish"
    }
  ],
  "messagesDelivered": [
    {
      "threatsInfoMap": [
        {
          "threat": "abc123def456...",
          "threatType": "attachment",
          "threatTime": "2024-01-01T13:00:00Z",
          "threatUrl": "https://threatinfo.proofpoint.com/...",
          "classification": "malware"
        },
        {
          "threat": "https://malicious-url.com",
          "threatType": "url",
          "threatTime": "2024-01-01T13:15:00Z",
          "threatUrl": "https://threatinfo.proofpoint.com/...",
          "classification": "phish"
        }
      ]
    }
  ],
  "messagesBlocked": [
    {
      "threatsInfoMap": [
        {
          "threat": "def789ghi012...",
          "threatType": "attachment",
          "threatTime": "2024-01-01T14:00:00Z",
          "threatUrl": "https://threatinfo.proofpoint.com/...",
          "classification": "spam"
        }
      ]
    }
  ]
}

Performance Matrix

This reading is conducted on a Large CE Stack with below-mentioned specs by pulling 100k IOCs from each page and pushing 100k IOCs to Proofpoint.

User Agent

netskope-ce-6.1.0-cte-proofpoint-v2.0.0

Workflow

1. Get your credentials from Proofpoint.
2. Configure the Proofpoint Plugin.
3. Configure a Business Rule for Proofpoint Plugin.
4. Configure Sharing for Proofpoint Plugin.
5. Validate the Proofpoint Plugin.

Watch a Video

Click play to watch a video.

Get your Credentials from Proofpoint

1. Log in to Proofpoint TAP Dashboard and go to Settings.

   

2. In Settings, go to Connected Applications.

   

3. Click Create New Credential.

   

4. Enter a Name and select an External Service for the credential.

   

5. Copy the generated Service Principal and Secret as they will be used to configure the plugin in Cloud Exchange. When finished, click Done.

   

Configure the Proofpoint Plugin

1. In Cloud Exchange, go to Settings > Plugin Store.

2. Search for and select the Proofpoint v2.0.0 (CTE) plugin.

   

3. Enter the Basic Information:

   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Interval to fetch data from this plugin and share data to this plugin from other sources.
     Note that it is better to have a larger value for Sync Interval if you want to pull IoCs in large numbers.
   • Aging Criteria: Expiry time of the plugin in days (Default: 90)
   • Override Reputation: Set a value to override the reputation of indicators received from this configuration.
   • Enable SSL Validation: Enable SSL Certificate validation.

   

4. Click Next and enter the Configuration Parameters:

   • Base URL: Proofpoint TAP API Base URL, like https://tap-api-v2.proofpoint.com.
   • Username: Proofpoint Service Principal.
   • Password: Proofpoint Secret.
   • Event Types: Select event types to pull threat indicators (URL, SHA256, Domain, and FQDN) from Proofpoint. If no event types are selected, all event types will be included by default.
   • Enable Tagging: Enable/Disable tagging functionality.
   • Retraction Interval: Number of hours to use as the retraction interval for Proofpoint IoC(s) retraction. Valid values are in range from 1 to 168 hours. This parameter will only be considered if IoC(s) Retraction is enabled in the Threat Exchange Settings.
   • Initial Range: Number of hours Threat IoCs to pull in the initial run. Valid values are in range from 1 to 168 hours.

   

5. Click Save.

   

Configure a Threat Exchange Business Rule for Proofpoint

To share indicators fetched from the Proofpoint to the Cloud Exchange, you need to have a business rule that will filter out the indicators that you want to share.

1. In Threat Exchange, go to Business Rules and click Create New Rule.

2. Add the filter according to your requirement in the rule.

   

3. Click Save.

   

Configure Threat Exchange Sharing for Proofpoint Plugin

To share IoCs from Proofpoint to Netskope Cloud Exchange:

1. In Threat Exchange, go to Sharing and click Add Sharing Configuration.
2. Select your Source Configuration (CTE Proofpoint), Business Rule, Destination Configuration (CTE Netskope), and Target. 
3. Click Save.

Validate the Proofpoint Plugin

Validate the Pull

To verify pulled logs in Cloud Exchange, go to Logging and search logs from the CTE Proofpoint plugin. You can filter the logs using the filter: message Like “[<plugin configuration name>]”.

Pulled data will be listed on the Threat IoCs page. You can filter the IoCs pulled from the platform using the filter: sources.source Like “<plugin configuration name>”.

Validate the Pull Retraction

To verify the Retracted IoCs, check the logs for IoC Retraction example: message Like CTE Proofpoint [CTE Proofpoint] [Retraction].

You can filter the retracted IoCs from the platform using the filter: sources.source Is equal “<plugin configuration name>” && sources.retracted Is equal true.

Validate the Push

Here you can see IoCs were added to the Destination Profile on Netskope Tenant.

Then some of the shared IoCs got marked as retracted so it was deleted from the list.

Troubleshooting the Proofpoint Plugin

Unable to pull IoCs from the Proofpoint platform

After the plugin configuration, if the IoCs are not pulled from the platform, it might be due to one of these reasons:

• No IoCs are available on the platform to pull
• IoCs are not available for the given configuration parameters (like Initial Range).

What to do: Identity your root cause from above and follow one of these steps to resolve the issue.

No IoCs are available on the platform to pull:

Check if the IoCs are available on the platform to pull. If available, check the resolution for the next point.

IoCs are not available for the given time range

If the IoCs are available on the platform to pull, but the plugin has not pulled the IoCs in CE, check the number of days mentioned in the initial range parameter of the plugin configuration. On the Proofpoint platform, check if you have data for the given time range.