--- title: ProofPoint Emerging Threat Intelligence slug: connectors/proofpoint-emerging-threat-intelligence docTags: createdAt: 2026-06-09T16:30:08.785Z --- The ProofPoint Emerging Threat Intelligence connector enables automated access to threat intelligence data, allowing users to assess domain and IP reputations and investigate malware samples. ProofPoint Emerging Threat Intelligence offers a comprehensive suite of threat intelligence data, enabling users to assess domain, IP, and malware sample reputations. This connector allows Swimlane Turbine users to automate the retrieval of reputation scores and metadata, enhancing their security operations with timely and accurate threat intelligence. By integrating with ProofPoint, users can proactively identify and respond to emerging threats, streamline investigations, and bolster their overall security posture without the need for manual queries or coding. ### Limitations None to date. ### Supported Versions This connector supports the latest version of the Proofpoint Emerging Threat Intelligence REST API. ## Additional Docs - [Proofpoint ET Intelligence Authentication Link](https://apidocs.emergingthreats.net/#authentication) - [Proofpoint ET Intelligence API Docs](https://apidocs.emergingthreats.net/#introduction) ## Configuration ### Prerequisites To effectively utilize the ProofPoint Emerging Threat Intelligence connector within Swimlane Turbine, ensure you have the following: - API Key Authentication with the necessary parameters: - URL: The endpoint URL for accessing ProofPoint services. - API Token: A unique identifier used to authenticate requests to the ProofPoint API. ## Authentication Methods To effectively utilize the Proofpoint Emerging Threat Intelligence connector within Swimlane Turbine, ensure you have the following: - API Key Authentication with the necessary parameters: - URL: The endpoint URL for the Proofpoint ET API. - API Key: Your unique authentication key provided by Proofpoint to access the ET Intelligence services. ## Capabilities This Connector provides the following capabilities: - Get Current Domain Reputation - Get current IP Reputation - Get Sample Details ### Get Current Domain Reputation This action retrieves the current reputation scores in categories that are currently associated with the specified domain. Proofpoint ET Intelligence's Documentation for this action can be found [here](https://apidocs.emergingthreats.net/#get-current-domain-reputation). ### Get current IP Reputation This action retrieves the current reputation scores in categories that are currently associated with the specified IP. Proofpoint ET Intelligence's Documentation for this action can be found [here](https://apidocs.emergingthreats.net/#get-current-ip-reputation). ### Get Sample Details This action retrieves metadata information for a single malware sample. Proofpoint ET Intelligence's Documentation for this action can be found [here](https://apidocs.emergingthreats.net/#get-sample-details). # Configurations ## Proofpoint ET Intelligence API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | Authorization | API Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Current Domain Reputation Retrieve current reputation scores for a specified domain from ProofPoint Emerging Threat Intelligence, including various category assessments. ### Endpoint - **URL:** `/v1/domains/{{domain}}/reputation` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------- | | `path_parameters.domain` | string | Required | The domain name to check. | ### Input Example `{"path_parameters":{"domain":"google.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `response` | array | Output field: response | | `response.category` | string | Output field: response.category | | `response.score` | number | Score value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":[{},{},{}]}}` ## Get current IP Reputation Retrieve the latest reputation scores and categories for a specific IP from Proofpoint Emerging Threat Intelligence. ### Endpoint - **URL:** `/v1/ips/{{ip}}/reputation` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------ | | `path_parameters.ip` | string | Required | The IP address to check. | ### Input Example `{"path_parameters":{"ip":"192.168.1.1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `response` | array | Output field: response | | `response.category` | string | Output field: response.category | | `response.score` | number | Score value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":[{},{},{}]}}` ## Get Sample Details Retrieve metadata for a specific malware sample using its MD5 hash from ProofPoint Emerging Threat Intelligence. ### Endpoint - **URL:** `/v1/samples/{{md5}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------- | | `path_parameters.md5` | string | Required | The MD5 hash of the binary sample. | ### Input Example `{"path_parameters":{"md5":"fa86e86e9dfb7a4571b3c3091fbf4bff"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `response` | object | Output field: response | | `response.md5sum` | string | Output field: response.md5sum | | `response.submit_date` | string | Date value | | `response.file_type` | string | Type of the resource | | `response.file_size` | number | Output field: response.file\_size | | `response.sha256` | string | Output field: response.sha256 | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"success":true,"response":{"md5sum":"fa86e86e9dfb7a4571b3c3091fbf4bff","submit_date":"2012-06-11 04:00:00","file_type":"PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit","file_size":69459,"sha256":"e12012672d33cbcb22cf953ff787af250f8f5e920c565f03d4496a619c13a889"}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |