ProofPoint Emerging Threat Intelligence
The ProofPoint Emerging Threat Intelligence connector enables automated access to threat intelligence data, allowing users to assess domain and IP reputations and investigate malware samples.
ProofPoint Emerging Threat Intelligence offers a comprehensive suite of threat intelligence data, enabling users to assess domain, IP, and malware sample reputations. This connector allows Swimlane Turbine users to automate the retrieval of reputation scores and metadata, enhancing their security operations with timely and accurate threat intelligence. By integrating with ProofPoint, users can proactively identify and respond to emerging threats, streamline investigations, and bolster their overall security posture without the need for manual queries or coding.
Limitations
None to date.
Supported Versions
This connector supports the latest version of the Proofpoint Emerging Threat Intelligence REST API.
Additional Docs
Configuration
Prerequisites
To effectively utilize the ProofPoint Emerging Threat Intelligence connector within Swimlane Turbine, ensure you have the following:
- API Key Authentication with the necessary parameters:
- URL: The endpoint URL for accessing ProofPoint services.
- API Token: A unique identifier used to authenticate requests to the ProofPoint API.
Authentication Methods
To effectively utilize the Proofpoint Emerging Threat Intelligence connector within Swimlane Turbine, ensure you have the following:
- API Key Authentication with the necessary parameters:
- URL: The endpoint URL for the Proofpoint ET API.
- API Key: Your unique authentication key provided by Proofpoint to access the ET Intelligence services.
Capabilities
This Connector provides the following capabilities:
- Get Current Domain Reputation
- Get current IP Reputation
- Get Sample Details
Get Current Domain Reputation
This action retrieves the current reputation scores in categories that are currently associated with the specified domain.
Proofpoint ET Intelligence's Documentation for this action can be found here.
Get current IP Reputation
This action retrieves the current reputation scores in categories that are currently associated with the specified IP.
Proofpoint ET Intelligence's Documentation for this action can be found here.
Get Sample Details
This action retrieves metadata information for a single malware sample.
Proofpoint ET Intelligence's Documentation for this action can be found here.
Configurations
Proofpoint ET Intelligence API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
Authorization | API Token | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Current Domain Reputation
Retrieve current reputation scores for a specified domain from ProofPoint Emerging Threat Intelligence, including various category assessments.
Endpoint
- URL: /v1/domains/{{domain}}/reputation
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.domain | string | Required | The domain name to check. |
Input Example
{"path_parameters":{"domain":"google.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
response | array | Output field: response |
response.category | string | Output field: response.category |
response.score | number | Score value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":[{},{},{}]}}
Get current IP Reputation
Retrieve the latest reputation scores and categories for a specific IP from Proofpoint Emerging Threat Intelligence.
Endpoint
- URL: /v1/ips/{{ip}}/reputation
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.ip | string | Required | The IP address to check. |
Input Example
{"path_parameters":{"ip":"192.168.1.1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
response | array | Output field: response |
response.category | string | Output field: response.category |
response.score | number | Score value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":[{},{},{}]}}
Get Sample Details
Retrieve metadata for a specific malware sample using its MD5 hash from ProofPoint Emerging Threat Intelligence.
Endpoint
- URL: /v1/samples/{{md5}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.md5 | string | Required | The MD5 hash of the binary sample. |
Input Example
{"path_parameters":{"md5":"fa86e86e9dfb7a4571b3c3091fbf4bff"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
response | object | Output field: response |
response.md5sum | string | Output field: response.md5sum |
response.submit_date | string | Date value |
response.file_type | string | Type of the resource |
response.file_size | number | Output field: response.file_size |
response.sha256 | string | Output field: response.sha256 |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":{"md5sum":"fa86e86e9dfb7a4571b3c3091fbf4bff","submit_date":"2012-06-11 04:00:00","file_type":"PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit","file_size":69459,"sha256":"e12012672d33cbcb22cf953ff787af250f8f5e920c565f03d4496a619c13a889"}}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |