ProofPoint Threat Response

This connector integrates Threat Response with Swimlane Turbine. It provides functionality and supports customizations and custom integrations.

Prerequisites

Before utilizing the ProofPoint Threat Response connector with Swimlane Turbine, ensure you have the following prerequisites:

API Key Authentication with the following parameters:

URL: Endpoint URL for the ProofPoint Threat Response API.

API Token: Unique token used to authenticate against the ProofPoint Threat Response API.

Capabilities

This connector provides the following capabilities:

Add Member To List

Add Incident Comments

Add User To Incident

Block URLs, Domains, Hashes, or IPs

Close Incident

Close Multiple Incidents

Delete Member Of List

Get Alert Details

Get All List Members

Get Incident Details

Get Incidents

Get Investigation Details

Get Single List Member

Ingest An Alert

Update Incident Description ... and so on

Update Incident Description

Setting "Overwrite" to false will append the specified description to the existing value in the incident. Setting "Overwrite" to true will overwrite the specified description over the existing value in the incident.

Ingest Alert

The ProofPoint Threat Response connector facilitates seamless integration with Swimlane Turbine, enabling automated security incident management and response.

ProofPoint Threat Response is a robust threat management platform that enables security teams to identify, investigate, and respond to threats quickly. This connector allows Swimlane Turbine users to automate incident response actions, manage lists and members, and ingest alerts directly within the platform. By integrating with ProofPoint Threat Response, users can streamline their security operations, enhance incident data with comments, manage blocklists, and close incidents efficiently, all through automated workflows.

Inputs

Input	Example
email attachments	[{"content_type": "JPEG", "date": "2014-01-01T10:11:12Z", "md5": "somemd5sumhere", "name": "attachment1.atch", "sha256": "somesha256here", "size": 567}]
classification	Supported classifications: - malware - policy-violation - vulnerability - network - spam - phish - command-and-control - data-match - authentication - system-behavior - impostor - reported-abuse - unknown
cnc hosts	[ { "host": "cnc1.com", "port": 443 }, { "host": "cnc2.com", "port": 22 } ]
forensics_hosts	['{"host": "forensics1.com","port": 80}', '{"host": "forensics2.com","port": 443}']
link_attribute	Supported attributes for linking: - target_ip_address - target_hostname - target_machine_name - target_user - target_mac_address - attacker_ip_address - attacker_hostname - attacker_machine_name - attacker_user - attacker_mac_address - email_recipient - email_sender - email_subject - message_id - threat_filename - threat_filehash
severity	Supported values: - info - minor - moderate - major - critical - Informational* - Low* - Medium* - High* - Critical*
custom fields	{ "custom_field_1": "custom value string 1", "custom_field_2": "custom value string 2", "custom_field_3": "custom value string 3", "custom_field_4": "custom value string 4", "custom_field_5": "custom value string 5", "custom_field_6": "custom value string 6" }

API Documentation

For more information, click here

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Authorization	API Token	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Incident Comments

Add a user-defined comment to an existing incident in ProofPoint Threat Response using the specified incident ID and summary.

Endpoint

URL: /api/incidents/{{incident_id}}/comments.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Add Incident Comments action
summary	string	Optional	Parameter for Add Incident Comments
detail	string	Optional	Parameter for Add Incident Comments

Input Example

{"json_body":{"summary":"General idea behind the comment","detail":"More in depth explanation"},"path_parameters":{"incident_id":16}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
incident_id	number	Unique identifier
response_id	object	Unique identifier
user_id	object	Unique identifier
history_type	string	Type of the resource
state_from	string	Output field: state_from
state_to	string	Output field: state_to
summary	string	Output field: summary
detail	string	Output field: detail
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":56,"incident_id":16,"response_id":null,"user_id":null,"history_type":"comment","state_from":"none","state_to":"none","summary":"comments here","detail":"details here","created_at":"2017-01-17T20:58:38Z","updated_at":"2017-01-17T20:58:38Z"}}

Add Member To List

Adds a specified member to a designated list in ProofPoint Threat Response using the provided list ID.

Endpoint

URL: /api/lists/{{list_id}}/members.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Add Member To List action
member	string	Optional	Parameter for Add Member To List
description	string	Optional	Parameter for Add Member To List
expiration	string	Optional	Timestamp to expire member. Format -2017-01-11T03:47:15Z
duration	string	Optional	(#) of milliseconds after which to expire membership. Expiration takes precedence.

Input Example

{"json_body":{"member":"175.76.13.144","description":"IP to block","expiration":"2018-12-18 18:59:51.545783","duration":"Duration"},"path_parameters":{"list_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
list_id	number	Unique identifier
host_id	number	Unique identifier
response_id	object	Unique identifier
reverse_user_id	object	Unique identifier
hash_reputation_id	object	Unique identifier
user_id	object	Unique identifier
enabled	boolean	Output field: enabled
deleted	boolean	Output field: deleted
description	string	Output field: description
expiration	string	Output field: expiration
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
host	object	Output field: host
host.created_at	string	Output field: host.created_at
host.host	string	Output field: host.host
host.id	number	Unique identifier
host.resolution_state	number	Output field: host.resolution_state
host.ttl	number	Output field: host.ttl
host.updated_at	string	Output field: host.updated_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":8,"list_id":2,"host_id":20,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"IP to block","expiration":"2018-12-18T19:08:56Z","created_at":"2017-01-11T03:47:15Z","updated_at":"2017-01-11T03:47:15Z","host":{"created_at":"2017-01-11T03:47:15Z","host":"75....

Add User To Incident

Adds specified users to an existing incident as targets or attackers in ProofPoint Threat Response, utilizing the given incident ID.

Endpoint

URL: /api/incidents/{{incident_id}}/users.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Add User To Incident action
targets	array	Optional	Parameter for Add User To Incident
attackers	array	Optional	Parameter for Add User To Incident

Input Example

{"json_body":{"targets":["user1"],"attackers":["user2"]},"path_parameters":{"incident_id":16}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Block URLs, Domains, Hashes, or IPs

Blocks URLs, domains, hashes, or IP addresses in ProofPoint Threat Response using a list ID and provided blacklist elements.

Endpoint

URL: /api/lists/{{list_id}}/members.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Block URLs, Domains, Hashes, or IPs action
blacklist_elements	array	Optional	Parameter for Block URLs, Domains, Hashes, or IPs
expiration	string	Optional	Parameter for Block URLs, Domains, Hashes, or IPs

Input Example

{"json_body":{"blacklist_elements":["150.150.150.150"],"expiration":"2018-12-18 18:59:51.545783"},"path_parameters":{"list_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
host_host	string	Output field: host_host
host_id	array	Unique identifier
host_created_at	string	Output field: host_created_at
expiration	string	Output field: expiration
hash_reputation_id	string	Unique identifier
list_id	number	Unique identifier
raw_json	object	Output field: raw_json
updated_at	string	Output field: updated_at
enabled	boolean	Output field: enabled
host_ttl	number	Output field: host_ttl
description	string	Output field: description
created_at	string	Output field: created_at
user_id	string	Unique identifier
host_resolution_state	number	Output field: host_resolution_state
id	number	Unique identifier
reverse_user_id	string	Unique identifier
deleted	boolean	Output field: deleted
host_updated_at	string	Output field: host_updated_at
response_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"host_host":"Host","host_id":["150.150.150.150"],"host_created_at":"2017-12-18 18:59:51.545783","expiration":"2018-12-18 18:59:51.545783","hash_reputation_id":"Hash Reputation ID","list_id":3,"raw_json":{},"updated_at":"2018-12-18 18:59:51.545783","enabled":true,"host_ttl":13,"description":"Description","created_at":"2018-12-18 18:59:5...

Close Incident

Closes a specified incident in ProofPoint Threat Response using the incident ID, along with a summary and detailed explanation.

Endpoint

URL: /api/incidents/{{incident_id}}/close.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Close Incident action
summary	string	Optional	Parameter for Close Incident
detail	string	Optional	Parameter for Close Incident

Input Example

{"json_body":{"summary":"Closing incident","detail":"Message has been quarantined and user has been notified."},"path_parameters":{"incident_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Close Multiple Incidents

Closes multiple incidents in ProofPoint Threat Response by specified IDs within a creation date range.

Endpoint

URL: /api/incidents/close.json

Method: POST

Input

Argument Name	Type	Required	Description
parameters.incidentIds	string	Required	This should be a comma separated list of incidents ids.
parameters.created_after	string	Required	Created_after cannot be a greater date than created_before. Accepted format is YYYY-MM-DD.
parameters.created_before	string	Required	Created_before must be a lesser date than created_after. Accepted format is YYYY-MM-DD.
close_summary	string	Optional	This optional parameter allows for a closing summary to be placed into each closed incident.
close_detail	string	Optional	This optional parameter allows for a closing details to be placed into each closed incident.

Input Example

{"parameters":{"incidentIds":[1605,2245],"created_after":"2019-05-29","created_before":"2020-05-29"},"json_body":{"close_summary":"","close_detail":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"Incidents Closed."}}

Delete Member Of List

Removes a specific member from a designated list in ProofPoint Threat Response using unique list and member identifiers.

Endpoint

URL: /api/lists/{{list_id}}/members/{{member_id}}.json

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Delete Member Of List action
path_parameters.member_id	number	Required	Parameters for the Delete Member Of List action

Input Example

{"path_parameters":{"list_id":2,"member_id":4}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Get Alert Details

Retrieve detailed information for a specific alert in ProofPoint Threat Response using the provided alert ID.

Endpoint

URL: /api/v1/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.id	number	Required	Parameters for the Get Alert Details action

Input Example

{"parameters":{"id":3}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
severity	string	Output field: severity
source	string	Output field: source
state	string	Output field: state
attackDirection	string	Output field: attackDirection
received	string	Output field: received
emails	array	Output field: emails
emails.sender	object	Output field: emails.sender
emails.sender.email	string	Output field: emails.sender.email
emails.recipient	object	Output field: emails.recipient
emails.recipient.email	string	Output field: emails.recipient.email
emails.subject	string	Output field: emails.subject
emails.messageId	string	Unique identifier
emails.body	string	Request body data
emails.bodyType	string	Request body data
emails.headers	object	HTTP headers for the request
emails.headers.Thread-Index	string	HTTP headers for the request
emails.headers.Received	string	HTTP headers for the request
emails.headers.X-MS-TNEF-Correlator	string	HTTP headers for the request
emails.headers.Thread-Topic	string	HTTP headers for the request
emails.headers.Message-ID	string	HTTP headers for the request
emails.headers.Content-Transfer-Encoding	string	HTTP headers for the request
emails.headers.X-MS-Exchange-Organization-AuthAs	string	HTTP headers for the request

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":3,"severity":"Info","source":"Abuse Mailbox Monitor","state":"Linked","attackDirection":"inbound","received":"2019-02-25T17:22:48Z","emails":[{},{}]}}

Get All List Members

Retrieve all members from a specified list in ProofPoint Threat Response, requiring list ID and member type.

Endpoint

URL: /api/lists/{{list_id}}/{{member_type}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Get All List Members action
path_parameters.member_type	string	Required	The information format to get in return. Available options include members.pan(for published lists) members.bluecoat(for published lists) members.json.

Input Example

{"path_parameters":{"list_id":2,"member_type":"members.json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":8,"list_id":2,"host_id":20,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"IP to block","expiration":"2018-12-18T19:08:56Z","created_at":"2017-01-11T03:47:15Z","updated_at":"2017-01-11T03:47:15Z","host":{}},{"id":6,"list_id":2,"host_id":6,"response_i...

Get Incident Details

Retrieve detailed information for a specific incident by providing the incident ID in ProofPoint Threat Response.

Endpoint

URL: /api/incidents/{{incident_id}}.json

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Get Incident Details action
parameters.expand_events	boolean	Optional	Parameters for the Get Incident Details action

Input Example

{"parameters":{"expand_events":true},"path_parameters":{"incident_id":3}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
type	string	Type of the resource
summary	string	Output field: summary
description	string	Output field: description
score	number	Score value
state	string	Output field: state
created_at	string	Output field: created_at
false_positive_count	number	Count value
event_count	number	Count value
event_sources	array	Output field: event_sources
users	array	Output field: users
assignee	string	Output field: assignee
team	string	Output field: team
hosts	object	Output field: hosts
hosts.attacker	array	Output field: hosts.attacker
hosts.forensics	array	Output field: hosts.forensics
incident_field_values	array	Unique identifier
incident_field_values.name	string	Unique identifier
incident_field_values.value	string	Unique identifier
events	array	Output field: events
events.id	number	Unique identifier
events.category	string	Output field: events.category
events.severity	string	Output field: events.severity

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":1,"type":"Malware","summary":"Unsolicited Bulk Email","description":"EvilScheme test message","score":4200,"state":"Open","created_at":"2018-05-26T21:07:17Z","false_positive_count":0,"event_count":3,"event_sources":["Proofpoint TAP"],"users":["nbadguy"],"assignee":"Unassigned","team":"Unassigned","hosts":{"attacker":[],"forensics"...

Get Incidents

Gathers detailed information from multiple incidents within ProofPoint Threat Response for comprehensive analysis and response.

Endpoint

URL: /api/incidents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.state	string	Optional	State of the incidents to retrive.
parameters.created_after	string	Optional	Retrieve incidents that were created after specified date, in ISO 8601 format (UTC).
parameters.created_before	string	Optional	Retrieve incidents that were created before specified date, in ISO 8601 format (UTC).
parameters.closed_after	string	Optional	Retrieve incidents that were closed after specified date, in ISO 8601 format (UTC).
parameters.closed_before	string	Optional	Retrieve incidents that were closed before specified date, in ISO 8601 format (UTC).
parameters.closed_at	string	Optional	Retrieve incidents that were closed at on a specific date. example - closed_at=yyyy-mm-dd.
parameters.updated_at	string	Optional	Retrieve incidents that were updated at on a specific date. example - updated_at=yyyy-mm-dd.
parameters.format_to_timezone	string	Optional	When specified the all time values in the response will be in the specified timezone. Please note that the typical + is represented with ’%2b’ in the call, where as the use of - is accepted as is. example request - format_to_timezone=utc%2b6:00 for specifying a + symbol in UTC+6:00. Whereas the use of UTC-6:00 may be represented as format_to_timezone=utc-6:00.
parameters.expand_events	string	Optional	Retrieve incidents with events data expanded.
parameters.sender	string	Optional	Retrieve incidents with a specific sender. This parameter accepts single or multiple entries. Separate multiple entries with a comma as shown.
parameters.recipient	string	Optional	Retrieve incidents with a specific recipient. This parameter accepts single or multiple entries. Separate multiple entries with a comma as shown.
parameters.ip	string	Optional	Retrieve incidents by the attacker’s (sender’s) IP address.
parameters.message_id	string	Optional	Retrieve incidents by the message id enclosed in <>. This parameter accepts single or multiple entries. Multiple entries shold be separated with a comma as shown in the example.
parameters.file_hash	string	Optional	Retrieve incidents which contain the specified file hash.
parameters.source_type	string	Optional	Retrieve incidents only belong to that source.
parameters.url	string	Optional	Retrieve incidents contain the specified url. This will look to match on the partial and full url.
parameters.file_name	string	Optional	Retrieve incidents which contain an attachment with the specified name.
parameters.file_type	string	Optional	Retrieve incidents which contain a certain type of attachment.
parameters.incident_value_fields_to_json	boolean	Optional	Specify if the response’s incident_field_values section should be returned as json.
parameters.disposition	string	Optional	Specify if the response’s incident_field_values section should be returned as json.
parameters.sub_disposition	string	Optional	Retrieve incidents which have either a Needs Manual Review or Likely Harmless sub-disposition. This parameter accepts either Needs Manual Review or Likely Harmless.
parameters.target_user	string	Optional	Retrieve incidents where the target user is specified.
parameters.threat_name	string	Optional	Retrieve incidents where the alert threat name is specified.
parameters.attack_vector	string	Optional	Retrieve incidents where the attack_vector is specified.
parameters.exclude_message_body	boolean	Optional	When set to True this will exclude the message body from the json response.

Input Example

{"parameters":{"state":"open","created_after":"2018-05-26T21:07:17Z","created_before":"2018-05-26T21:07:17Z","closed_after":"2018-05-26T21:07:17Z","closed_before":"2018-05-26T21:07:17Z","closed_at":"2015-03-25","updated_at":"2015-03-25","format_to_timezone":"UTC-6:00","expand_events":"true","sender":"[email protected]","recipient":"[email protected]","ip":"0.0.0.0","message_id":"[email protected]","file_hash":"234324fj23543jf","source_type":"abuse_mailbox_monitor","url":"www.foobar.com","file_name":"test.docx","file_type":"doc","incident_value_fields_to_json":true,"disposition":"Suspicious","sub_disposition":"Likely Harmless","target_user":"user12","threat_name":"impostor","attack_vector":"Email","exclude_message_body":true,"exclude_mime_content":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":1,"type":"Malware","summary":"Unsolicited Bulk Email","description":"EvilScheme test message","score":4200,"state":"Open","created_at":"2018-05-26T21:07:17Z","event_count":3,"event_sources":[],"users":[],"assignee":"Unassigned","team":"Unassigned","hosts":{},"incident_field_values":[],"events":[]},{"id":2,"type":"Reported-abuse",...

Get Investigation Details

Retrieve detailed information for a specific investigation in ProofPoint Threat Response using the provided investigation ID.

Endpoint

URL: /api/investigations/{{investigation_id}}.json

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.investigation_id	number	Required	Parameters for the Get Investigation Details action
parameters.expand_incidents	boolean	Optional	Parameters for the Get Investigation Details action
parameters.expand_events	boolean	Optional	Parameters for the Get Investigation Details action

Input Example

{"parameters":{"expand_incidents":true,"expand_events":false},"path_parameters":{"investigation_id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
name	string	Name of the resource
assignee	string	Output field: assignee
team	string	Output field: team
description	string	Output field: description
investigation_field_values	array	Value for the parameter
investigation_field_values.name	string	Name of the resource
investigation_field_values.value	string	Value for the parameter
incident_ids	array	Unique identifier
incidents	array	Unique identifier
incidents.file_name	string	Unique identifier
incidents.file	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":1,"created_at":"2021-01-08T17:20:07Z","updated_at":"2021-03-11T05:49:15Z","name":"test","assignee":"System Administrator","team":"Script Admins","description":"asdadad","investigation_field_values":[{"name":"Classification","value":"Malware"},{"name":"Severity","value":"Informational"},{"name":"Attack Vector","value":"Email"}],"in...

Get Single List Member

Retrieves a specific member from a list in ProofPoint Threat Response using the provided list and member IDs.

Endpoint

URL: /api/lists/{{list_id}}/members/{{member_id}}.json

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Get Single List Member action
path_parameters.member_id	number	Required	Parameters for the Get Single List Member action

Input Example

{"path_parameters":{"list_id":2,"member_id":6}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
list_id	number	Unique identifier
host_id	number	Unique identifier
response_id	object	Unique identifier
reverse_user_id	object	Unique identifier
hash_reputation_id	object	Unique identifier
user_id	object	Unique identifier
enabled	boolean	Output field: enabled
deleted	boolean	Output field: deleted
description	string	Output field: description
expiration	object	Output field: expiration
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
host	object	Output field: host
host.created_at	string	Output field: host.created_at
host.host	string	Output field: host.host
host.id	number	Unique identifier
host.resolution_state	number	Output field: host.resolution_state
host.ttl	number	Output field: host.ttl
host.updated_at	string	Output field: host.updated_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":6,"list_id":2,"host_id":6,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"test","expiration":null,"created_at":"2017-01-11T03:43:54Z","updated_at":"2017-01-11T03:43:54Z","host":{"created_at":"2016-12-29T04:56:13Z","host":"string","id":6,"resolution_st...

Ingest An Alert

Ingest an alert into ProofPoint Threat Response using a specified source ID, with required path parameters and JSON body.

Endpoint

URL: /threat/json_event/events/{{json_source_id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.json_source_id	string	Required	Parameters for the Ingest An Alert action
attacker	object	Optional	Parameter for Ingest An Alert
attacker.host_name	string	Optional	Name of the resource
attacker.ip_address	string	Optional	Parameter for Ingest An Alert
attacker.port	number	Optional	Parameter for Ingest An Alert
attacker.url	string	Optional	URL endpoint for the request
attacker.user	string	Optional	Parameter for Ingest An Alert
cnc_hosts	array	Optional	Parameter for Ingest An Alert
cnc_hosts.host	string	Optional	Parameter for Ingest An Alert
cnc_hosts.port	number	Optional	Parameter for Ingest An Alert
detector	object	Optional	Parameter for Ingest An Alert
detector.action	string	Optional	Parameter for Ingest An Alert
detector.event_category	string	Optional	Parameter for Ingest An Alert
detector.host_name	string	Optional	Name of the resource
detector.ip_address	string	Optional	Parameter for Ingest An Alert
detector.product	string	Optional	Parameter for Ingest An Alert
detector.vendor	string	Optional	Parameter for Ingest An Alert
email	object	Optional	Parameter for Ingest An Alert
email.attachments	array	Optional	Parameter for Ingest An Alert
email.attachments.content_type	string	Optional	Type of the resource
email.attachments.date	string	Optional	Date value
email.attachments.md5	string	Optional	Parameter for Ingest An Alert
email.attachments.name	string	Optional	Name of the resource
email.attachments.sha256	string	Optional	Parameter for Ingest An Alert
email.attachments.size	number	Optional	Parameter for Ingest An Alert

Input Example

{"json_body":{"json_version":"2.0","attacker":{"host_name":"evil.com","ip_address":"103.251.90.43","port":443,"url":"http://badurl.example.com","user":"user_id"},"classification":"Malware","cnc_hosts":[{"host":"cnc1.com","port":443},{"host":"cnc2.com","port":22}],"custom_fields":{"custom_field_1":"custom value string 1","custom_field_2":"custom value string 2","custom_field_3":"custom value string 3","custom_field_4":"custom value string 4","custom_field_5":"custom value string 5","custom_field_6":"custom value string 6"},"description":"A Description","detector":{"action":"Cleaned","event_category":"Malware","host_name":"siem.corp.domain.com","ip_address":"192.168.1.1","product":"SIEM product","vendor":"AwesomeSoft"},"email":{"attachments":[{"content_type":"JPEG","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment1.atch","sha256":"somesha256here","size":567},{"content_type":"HTML","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment2.atch","sha256":"somesha256here","size":567763}],"body":"some body text","body_type":"text","headers":{"foo":"bar","fooey":"barry"},"message_delivery_time":"2014-01-01T10:11:12Z","message_id":"abcdefg","recipient":"[email protected]","sender":"[email protected]","subject":"Click Me!","urls":["http://foo.com","https://bar.com/foobar/test?foo=5"]},"forensics_hosts":[{"host":"forensics1.com","port":80},{"host":"forensics2.com","port":443}],"link_attribute":"target_ip_address","severity":"medium","target":{"host_name":"host.yourdomain.com","ip_address":"10.10.111.111","mac_address":"01:23:45:67:89:ab","port":22,"url":"http://sample.example.com","user":"user_id"},"threat_info":{"filename":"malware.ppt","name":"Zeus","occurred_at":"2014-01-01T10:11:12Z","type":"Trojan"},"url":"http://www.badurl.com"},"path_parameters":{"json_source_id":"2"},"attacker":{"host_name":"evil.com","ip_address":"103.251.90.43","port":443,"url":"http://badurl.example.com","user":"user_id"},"cnc_hosts":[{"host":"cnc1.com","port":443},{"host":"cnc2.com","port":22}],"detector":{"action":"Cleaned","event_category":"Malware","host_name":"siem.corp.domain.com","ip_address":"192.168.1.1","product":"SIEM product","vendor":"AwesomeSoft"},"email":{"attachments":[{"content_type":"JPEG","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment1.atch","sha256":"somesha256here","size":567},{"content_type":"HTML","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment2.atch","sha256":"somesha256here","size":567763}],"body":"some body text","body_type":"text","headers":{"foo":"bar","fooey":"barry"},"message_delivery_time":"2014-01-01T10:11:12Z","message_id":"abcdefg","recipient":"[email protected]","sender":"[email protected]","subject":"Click Me!","urls":["http://foo.com","https://bar.com/foobar/test?foo=5"]},"forensics_hosts":[{"host":"forensics1.com","port":80},{"host":"forensics2.com","port":443}],"target":{"host_name":"host.yourdomain.com","ip_address":"10.10.111.111","mac_address":"01:23:45:67:89:ab","port":22,"url":"http://sample.example.com","user":"user_id"},"threat_info":{"filehash":"77b63872fabf3884d694f694a2a87e2e","filename":"malware.ppt","name":"Zeus","occurred_at":"2014-01-01T10:11:12Z","type":"Trojan"},"custom_fields":{"custom_field_1":"custom value string 1","custom_field_2":"custom value string 2","custom_field_3":"custom value string 3","custom_field_4":"custom value string 4","custom_field_5":"custom value string 5","custom_field_6":"custom value string 6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Update Incident Description

Updates an incident's description in ProofPoint Threat Response using a specific incident ID.

Endpoint

URL: /api/incidents/{{incident_id}}/description.json

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	number	Required	Parameters for the Update Incident Description action
description	string	Optional	Parameter for Update Incident Description
overwrite	string	Optional	Parameter for Update Incident Description

Input Example

{"json_body":{"description":"Handing off incident to threat research team","overwrite":"false"},"path_parameters":{"incident_id":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Update Member Of List

Updates a specific member within a list using the provided list and member IDs in ProofPoint Threat Response.

Endpoint

URL: /api/lists/{{list_id}}/members/{{member_id}}.json

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.list_id	number	Required	Parameters for the Update Member Of List action
path_parameters.member_id	number	Required	Parameters for the Update Member Of List action

Input Example

{"path_parameters":{"list_id":2,"member_id":6}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
list_id	number	Unique identifier
host_id	number	Unique identifier
response_id	object	Unique identifier
reverse_user_id	object	Unique identifier
hash_reputation_id	object	Unique identifier
user_id	object	Unique identifier
enabled	boolean	Output field: enabled
deleted	boolean	Output field: deleted
description	string	Output field: description
expiration	string	Output field: expiration
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
host	object	Output field: host
host.created_at	string	Output field: host.created_at
host.host	string	Output field: host.host
host.id	number	Unique identifier
host.resolution_state	number	Output field: host.resolution_state
host.ttl	number	Output field: host.ttl
host.updated_at	string	Output field: host.updated_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":4,"list_id":2,"host_id":4,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"Hello PTR","expiration":"2017-12-03T10:15:30Z","created_at":"2016-12-29T01:52:33Z","updated_at":"2017-01-13T00:55:27Z","host":{"created_at":"2016-12-29T01:52:33Z","host":"7.7.7....

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 23 Aug 2023 20:37:23 GMT