Skip to main content
The Proofpoint integration connects to Cloud Threat Response (CTR) using a Cloud Admin API key and secret.

​
Supported data

  • Message logs include sender, recipient, subject, disposition, CLEAR verdict and confidence, TAP threats and campaigns, URLs, attachments, delivery status, remediation status, and related CTR incidents.
  • Incident detections include Proofpoint’s incident title, priority, state, assignment, message count, dispositions, verdicts, confidence, source types, and VAP/VIP flags.
Sender and recipient values are indexed as user observables. CTR does not provide an authoritative user directory or managed endpoint inventory, so the integration does not synchronize users or endpoints.

​
Prerequisites

Create a dedicated API key in Cloud Admin → Settings → API Key Management → Threat Protection. Save the API key and secret when they are displayed. These credentials are different from the service principal and secret used by the TAP SIEM API.

​
Connect Proofpoint

  1. In Wirespeed, go to Settings → Integrations → Add Integration → Proofpoint.
  2. Enter the CTR API Key and API Secret.
  3. Save and enable the integration.

​
Synchronization behavior

Message and incident searches use bounded pagination and a three-day initial lookback. Message collection runs at most every five minutes. Cursor state only advances after Wirespeed successfully ingests the corresponding data. CTR message logs remain available for SIEM search and future managed detection rules. Proofpoint incident detections initially use a non-escalating default category until dedicated categorization rules are defined.

​
Not included

The integration does not retrieve message bodies, MIME content, dashboard reports, People/VAP reports, or TAP SIEM events. Closing or recategorizing a Wirespeed detection does not update the Proofpoint incident.