--- title: ProofPoint Threat Response slug: connectors/proofpoint-threat-response docTags: createdAt: 2026-06-09T16:30:31.162Z --- This connector integrates Threat Response with Swimlane Turbine. It provides functionality and supports customizations and custom integrations. ## Prerequisites Before utilizing the ProofPoint Threat Response connector with Swimlane Turbine, ensure you have the following prerequisites: - API Key Authentication with the following parameters: - URL: Endpoint URL for the ProofPoint Threat Response API. - API Token: Unique token used to authenticate against the ProofPoint Threat Response API. ## Capabilities This connector provides the following capabilities: - Add Member To List - Add Incident Comments - Add User To Incident - Block URLs, Domains, Hashes, or IPs - Close Incident - Close Multiple Incidents - Delete Member Of List - Get Alert Details - Get All List Members - Get Incident Details - Get Incidents - Get Investigation Details - Get Single List Member - Ingest An Alert - Update Incident Description *... and so on* ### Update Incident Description Setting "Overwrite" to false will append the specified description to the existing value in the incident. Setting "Overwrite" to true will overwrite the specified description over the existing value in the incident. ### Ingest Alert The ProofPoint Threat Response connector facilitates seamless integration with Swimlane Turbine, enabling automated security incident management and response. ProofPoint Threat Response is a robust threat management platform that enables security teams to identify, investigate, and respond to threats quickly. This connector allows Swimlane Turbine users to automate incident response actions, manage lists and members, and ingest alerts directly within the platform. By integrating with ProofPoint Threat Response, users can streamline their security operations, enhance incident data with comments, manage blocklists, and close incidents efficiently, all through automated workflows. ### Inputs | Input | Example | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | email attachments | \[\{"content\_type": "JPEG", "date": "2014-01-01T10:11:12Z", "md5": "somemd5sumhere", "name": "attachment1.atch", "sha256": "somesha256here", "size": 567}] | | classification | Supported classifications: - malware - policy-violation - vulnerability - network - spam - phish - command-and-control - data-match - authentication - system-behavior - impostor - reported-abuse - unknown | | cnc hosts | \[ \{ "host": "cnc1.com", "port": 443 }, \{ "host": "cnc2.com", "port": 22 } ] | | forensics\_hosts | \['\{"host": "forensics1.com","port": 80}', '\{"host": "forensics2.com","port": 443}'] | | link\_attribute | Supported attributes for linking: - target\_ip\_address - target\_hostname - target\_machine\_name - target\_user - target\_mac\_address - attacker\_ip\_address - attacker\_hostname - attacker\_machine\_name - attacker\_user - attacker\_mac\_address - email\_recipient - email\_sender - email\_subject - message\_id - threat\_filename - threat\_filehash | | severity | Supported values: - info - minor - moderate - major - critical - Informational\* - Low\* - Medium\* - High\* - Critical\* | | custom fields | \{ "custom\_field\_1": "custom value string 1", "custom\_field\_2": "custom value string 2", "custom\_field\_3": "custom value string 3", "custom\_field\_4": "custom value string 4", "custom\_field\_5": "custom value string 5", "custom\_field\_6": "custom value string 6" } | ### API Documentation For more information, click [here](https://ptr-docs.proofpoint.com/extensibility-guides/ptr-api/#) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | Authorization | API Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Incident Comments Add a user-defined comment to an existing incident in ProofPoint Threat Response using the specified incident ID and summary. ### Endpoint - **URL:** `/api/incidents/{{incident_id}}/comments.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.incident_id` | number | Required | Parameters for the Add Incident Comments action | | `summary` | string | Optional | Parameter for Add Incident Comments | | `detail` | string | Optional | Parameter for Add Incident Comments | ### Input Example `{"json_body":{"summary":"General idea behind the comment","detail":"More in depth explanation"},"path_parameters":{"incident_id":16}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `incident_id` | number | Unique identifier | | `response_id` | object | Unique identifier | | `user_id` | object | Unique identifier | | `history_type` | string | Type of the resource | | `state_from` | string | Output field: state\_from | | `state_to` | string | Output field: state\_to | | `summary` | string | Output field: summary | | `detail` | string | Output field: detail | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":56,"incident_id":16,"response_id":null,"user_id":null,"history_type":"comment","state_from":"none","state_to":"none","summary":"comments here","detail":"details here","created_at":"2017-01-17T20:58:38Z","updated_at":"2017-01-17T20:58:38Z"}}` ## Add Member To List Adds a specified member to a designated list in ProofPoint Threat Response using the provided list ID. ### Endpoint - **URL:** `/api/lists/{{list_id}}/members.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------- | | `path_parameters.list_id` | number | Required | Parameters for the Add Member To List action | | `member` | string | Optional | Parameter for Add Member To List | | `description` | string | Optional | Parameter for Add Member To List | | `expiration` | string | Optional | Timestamp to expire member. Format -2017-01-11T03:47:15Z | | `duration` | string | Optional | (#) of milliseconds after which to expire membership. Expiration takes precedence. | ### Input Example `{"json_body":{"member":"175.76.13.144","description":"IP to block","expiration":"2018-12-18 18:59:51.545783","duration":"Duration"},"path_parameters":{"list_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `list_id` | number | Unique identifier | | `host_id` | number | Unique identifier | | `response_id` | object | Unique identifier | | `reverse_user_id` | object | Unique identifier | | `hash_reputation_id` | object | Unique identifier | | `user_id` | object | Unique identifier | | `enabled` | boolean | Output field: enabled | | `deleted` | boolean | Output field: deleted | | `description` | string | Output field: description | | `expiration` | string | Output field: expiration | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | | `host` | object | Output field: host | | `host.created_at` | string | Output field: host.created\_at | | `host.host` | string | Output field: host.host | | `host.id` | number | Unique identifier | | `host.resolution_state` | number | Output field: host.resolution\_state | | `host.ttl` | number | Output field: host.ttl | | `host.updated_at` | string | Output field: host.updated\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":8,"list_id":2,"host_id":20,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"IP to block","expiration":"2018-12-18T19:08:56Z","created_at":"2017-01-11T03:47:15Z","updated_at":"2017-01-11T03:47:15Z","host":{"created_at":"2017-01-11T03:47:15Z","host":"75....` ## Add User To Incident Adds specified users to an existing incident as targets or attackers in ProofPoint Threat Response, utilizing the given incident ID. ### Endpoint - **URL:** `/api/incidents/{{incident_id}}/users.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.incident_id` | number | Required | Parameters for the Add User To Incident action | | `targets` | array | Optional | Parameter for Add User To Incident | | `attackers` | array | Optional | Parameter for Add User To Incident | ### Input Example `{"json_body":{"targets":["user1"],"attackers":["user2"]},"path_parameters":{"incident_id":16}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Block URLs, Domains, Hashes, or IPs Blocks URLs, domains, hashes, or IP addresses in ProofPoint Threat Response using a list ID and provided blacklist elements. ### Endpoint - **URL:** `/api/lists/{{list_id}}/members.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------- | | `path_parameters.list_id` | number | Required | Parameters for the Block URLs, Domains, Hashes, or IPs action | | `blacklist_elements` | array | Optional | Parameter for Block URLs, Domains, Hashes, or IPs | | `expiration` | string | Optional | Parameter for Block URLs, Domains, Hashes, or IPs | ### Input Example `{"json_body":{"blacklist_elements":["150.150.150.150"],"expiration":"2018-12-18 18:59:51.545783"},"path_parameters":{"list_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `host_host` | string | Output field: host\_host | | `host_id` | array | Unique identifier | | `host_created_at` | string | Output field: host\_created\_at | | `expiration` | string | Output field: expiration | | `hash_reputation_id` | string | Unique identifier | | `list_id` | number | Unique identifier | | `raw_json` | object | Output field: raw\_json | | `updated_at` | string | Output field: updated\_at | | `enabled` | boolean | Output field: enabled | | `host_ttl` | number | Output field: host\_ttl | | `description` | string | Output field: description | | `created_at` | string | Output field: created\_at | | `user_id` | string | Unique identifier | | `host_resolution_state` | number | Output field: host\_resolution\_state | | `id` | number | Unique identifier | | `reverse_user_id` | string | Unique identifier | | `deleted` | boolean | Output field: deleted | | `host_updated_at` | string | Output field: host\_updated\_at | | `response_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"host_host":"Host","host_id":["150.150.150.150"],"host_created_at":"2017-12-18 18:59:51.545783","expiration":"2018-12-18 18:59:51.545783","hash_reputation_id":"Hash Reputation ID","list_id":3,"raw_json":{},"updated_at":"2018-12-18 18:59:51.545783","enabled":true,"host_ttl":13,"description":"Description","created_at":"2018-12-18 18:59:5...` ## Close Incident Closes a specified incident in ProofPoint Threat Response using the incident ID, along with a summary and detailed explanation. ### Endpoint - **URL:** `/api/incidents/{{incident_id}}/close.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.incident_id` | number | Required | Parameters for the Close Incident action | | `summary` | string | Optional | Parameter for Close Incident | | `detail` | string | Optional | Parameter for Close Incident | ### Input Example `{"json_body":{"summary":"Closing incident","detail":"Message has been quarantined and user has been notified."},"path_parameters":{"incident_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Close Multiple Incidents Closes multiple incidents in ProofPoint Threat Response by specified IDs within a creation date range. ### Endpoint - **URL:** `/api/incidents/close.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------- | | `parameters.incidentIds` | string | Required | This should be a comma separated list of incidents ids. | | `parameters.created_after` | string | Required | Created\_after cannot be a greater date than created\_before. Accepted format is YYYY-MM-DD. | | `parameters.created_before` | string | Required | Created\_before must be a lesser date than created\_after. Accepted format is YYYY-MM-DD. | | `close_summary` | string | Optional | This optional parameter allows for a closing summary to be placed into each closed incident. | | `close_detail` | string | Optional | This optional parameter allows for a closing details to be placed into each closed incident. | ### Input Example `{"parameters":{"incidentIds":[1605,2245],"created_after":"2019-05-29","created_before":"2020-05-29"},"json_body":{"close_summary":"","close_detail":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"Incidents Closed."}}` ## Delete Member Of List Removes a specific member from a designated list in ProofPoint Threat Response using unique list and member identifiers. ### Endpoint - **URL:** `/api/lists/{{list_id}}/members/{{member_id}}.json` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.list_id` | number | Required | Parameters for the Delete Member Of List action | | `path_parameters.member_id` | number | Required | Parameters for the Delete Member Of List action | ### Input Example `{"path_parameters":{"list_id":2,"member_id":4}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Get Alert Details Retrieve detailed information for a specific alert in ProofPoint Threat Response using the provided alert ID. ### Endpoint - **URL:** `/api/v1/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------- | | `parameters.id` | number | Required | Parameters for the Get Alert Details action | ### Input Example `{"parameters":{"id":3}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `severity` | string | Output field: severity | | `source` | string | Output field: source | | `state` | string | Output field: state | | `attackDirection` | string | Output field: attackDirection | | `received` | string | Output field: received | | `emails` | array | Output field: emails | | `emails.sender` | object | Output field: emails.sender | | `emails.sender.email` | string | Output field: emails.sender.email | | `emails.recipient` | object | Output field: emails.recipient | | `emails.recipient.email` | string | Output field: emails.recipient.email | | `emails.subject` | string | Output field: emails.subject | | `emails.messageId` | string | Unique identifier | | `emails.body` | string | Request body data | | `emails.bodyType` | string | Request body data | | `emails.headers` | object | HTTP headers for the request | | `emails.headers.Thread-Index` | string | HTTP headers for the request | | `emails.headers.Received` | string | HTTP headers for the request | | `emails.headers.X-MS-TNEF-Correlator` | string | HTTP headers for the request | | `emails.headers.Thread-Topic` | string | HTTP headers for the request | | `emails.headers.Message-ID` | string | HTTP headers for the request | | `emails.headers.Content-Transfer-Encoding` | string | HTTP headers for the request | | `emails.headers.X-MS-Exchange-Organization-AuthAs` | string | HTTP headers for the request | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":3,"severity":"Info","source":"Abuse Mailbox Monitor","state":"Linked","attackDirection":"inbound","received":"2019-02-25T17:22:48Z","emails":[{},{}]}}` ## Get All List Members Retrieve all members from a specified list in ProofPoint Threat Response, requiring list ID and member type. ### Endpoint - **URL:** `/api/lists/{{list_id}}/{{member_type}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.list_id` | number | Required | Parameters for the Get All List Members action | | `path_parameters.member_type` | string | Required | The information format to get in return. Available options include members.pan(for published lists) members.bluecoat(for published lists) members.json. | ### Input Example `{"path_parameters":{"list_id":2,"member_type":"members.json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":8,"list_id":2,"host_id":20,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"IP to block","expiration":"2018-12-18T19:08:56Z","created_at":"2017-01-11T03:47:15Z","updated_at":"2017-01-11T03:47:15Z","host":{}},{"id":6,"list_id":2,"host_id":6,"response_i...` ## Get Incident Details Retrieve detailed information for a specific incident by providing the incident ID in ProofPoint Threat Response. ### Endpoint - **URL:** `/api/incidents/{{incident_id}}.json` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.incident_id` | number | Required | Parameters for the Get Incident Details action | | `parameters.expand_events` | boolean | Optional | Parameters for the Get Incident Details action | ### Input Example `{"parameters":{"expand_events":true},"path_parameters":{"incident_id":3}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `type` | string | Type of the resource | | `summary` | string | Output field: summary | | `description` | string | Output field: description | | `score` | number | Score value | | `state` | string | Output field: state | | `created_at` | string | Output field: created\_at | | `false_positive_count` | number | Count value | | `event_count` | number | Count value | | `event_sources` | array | Output field: event\_sources | | `users` | array | Output field: users | | `assignee` | string | Output field: assignee | | `team` | string | Output field: team | | `hosts` | object | Output field: hosts | | `hosts.attacker` | array | Output field: hosts.attacker | | `hosts.forensics` | array | Output field: hosts.forensics | | `incident_field_values` | array | Unique identifier | | `incident_field_values.name` | string | Unique identifier | | `incident_field_values.value` | string | Unique identifier | | `events` | array | Output field: events | | `events.id` | number | Unique identifier | | `events.category` | string | Output field: events.category | | `events.severity` | string | Output field: events.severity | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":1,"type":"Malware","summary":"Unsolicited Bulk Email","description":"EvilScheme test message","score":4200,"state":"Open","created_at":"2018-05-26T21:07:17Z","false_positive_count":0,"event_count":3,"event_sources":["Proofpoint TAP"],"users":["nbadguy"],"assignee":"Unassigned","team":"Unassigned","hosts":{"attacker":[],"forensics"...` ## Get Incidents Gathers detailed information from multiple incidents within ProofPoint Threat Response for comprehensive analysis and response. ### Endpoint - **URL:** `/api/incidents` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.state` | string | Optional | State of the incidents to retrive. | | `parameters.created_after` | string | Optional | Retrieve incidents that were created after specified date, in ISO 8601 format (UTC). | | `parameters.created_before` | string | Optional | Retrieve incidents that were created before specified date, in ISO 8601 format (UTC). | | `parameters.closed_after` | string | Optional | Retrieve incidents that were closed after specified date, in ISO 8601 format (UTC). | | `parameters.closed_before` | string | Optional | Retrieve incidents that were closed before specified date, in ISO 8601 format (UTC). | | `parameters.closed_at` | string | Optional | Retrieve incidents that were closed at on a specific date. example - closed\_at=yyyy-mm-dd. | | `parameters.updated_at` | string | Optional | Retrieve incidents that were updated at on a specific date. example - updated\_at=yyyy-mm-dd. | | `parameters.format_to_timezone` | string | Optional | When specified the all time values in the response will be in the specified timezone. Please note that the typical + is represented with ’%2b’ in the call, where as the use of - is accepted as is. example request - format\_to\_timezone=utc%2b6:00 for specifying a + symbol in UTC+6:00. Whereas the use of UTC-6:00 may be represented as format\_to\_timezone=utc-6:00. | | `parameters.expand_events` | string | Optional | Retrieve incidents with events data expanded. | | `parameters.sender` | string | Optional | Retrieve incidents with a specific sender. This parameter accepts single or multiple entries. Separate multiple entries with a comma as shown. | | `parameters.recipient` | string | Optional | Retrieve incidents with a specific recipient. This parameter accepts single or multiple entries. Separate multiple entries with a comma as shown. | | `parameters.ip` | string | Optional | Retrieve incidents by the attacker’s (sender’s) IP address. | | `parameters.message_id` | string | Optional | Retrieve incidents by the message id enclosed in \<>. This parameter accepts single or multiple entries. Multiple entries shold be separated with a comma as shown in the example. | | `parameters.file_hash` | string | Optional | Retrieve incidents which contain the specified file hash. | | `parameters.source_type` | string | Optional | Retrieve incidents only belong to that source. | | `parameters.url` | string | Optional | Retrieve incidents contain the specified url. This will look to match on the partial and full url. | | `parameters.file_name` | string | Optional | Retrieve incidents which contain an attachment with the specified name. | | `parameters.file_type` | string | Optional | Retrieve incidents which contain a certain type of attachment. | | `parameters.incident_value_fields_to_json` | boolean | Optional | Specify if the response’s incident\_field\_values section should be returned as json. | | `parameters.disposition` | string | Optional | Specify if the response’s incident\_field\_values section should be returned as json. | | `parameters.sub_disposition` | string | Optional | Retrieve incidents which have either a Needs Manual Review or Likely Harmless sub-disposition. This parameter accepts either Needs Manual Review or Likely Harmless. | | `parameters.target_user` | string | Optional | Retrieve incidents where the target user is specified. | | `parameters.threat_name` | string | Optional | Retrieve incidents where the alert threat name is specified. | | `parameters.attack_vector` | string | Optional | Retrieve incidents where the attack\_vector is specified. | | `parameters.exclude_message_body` | boolean | Optional | When set to True this will exclude the message body from the json response. | ### Input Example `{"parameters":{"state":"open","created_after":"2018-05-26T21:07:17Z","created_before":"2018-05-26T21:07:17Z","closed_after":"2018-05-26T21:07:17Z","closed_before":"2018-05-26T21:07:17Z","closed_at":"2015-03-25","updated_at":"2015-03-25","format_to_timezone":"UTC-6:00","expand_events":"true","sender":"foo@bar.com","recipient":"foo@bar.com","ip":"0.0.0.0","message_id":"4f3d3xda2f@foo.com","file_hash":"234324fj23543jf","source_type":"abuse_mailbox_monitor","url":"www.foobar.com","file_name":"test.docx","file_type":"doc","incident_value_fields_to_json":true,"disposition":"Suspicious","sub_disposition":"Likely Harmless","target_user":"user12","threat_name":"impostor","attack_vector":"Email","exclude_message_body":true,"exclude_mime_content":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":1,"type":"Malware","summary":"Unsolicited Bulk Email","description":"EvilScheme test message","score":4200,"state":"Open","created_at":"2018-05-26T21:07:17Z","event_count":3,"event_sources":[],"users":[],"assignee":"Unassigned","team":"Unassigned","hosts":{},"incident_field_values":[],"events":[]},{"id":2,"type":"Reported-abuse",...` ## Get Investigation Details Retrieve detailed information for a specific investigation in ProofPoint Threat Response using the provided investigation ID. ### Endpoint - **URL:** `/api/investigations/{{investigation_id}}.json` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.investigation_id` | number | Required | Parameters for the Get Investigation Details action | | `parameters.expand_incidents` | boolean | Optional | Parameters for the Get Investigation Details action | | `parameters.expand_events` | boolean | Optional | Parameters for the Get Investigation Details action | ### Input Example `{"parameters":{"expand_incidents":true,"expand_events":false},"path_parameters":{"investigation_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | | `name` | string | Name of the resource | | `assignee` | string | Output field: assignee | | `team` | string | Output field: team | | `description` | string | Output field: description | | `investigation_field_values` | array | Value for the parameter | | `investigation_field_values.name` | string | Name of the resource | | `investigation_field_values.value` | string | Value for the parameter | | `incident_ids` | array | Unique identifier | | `incidents` | array | Unique identifier | | `incidents.file_name` | string | Unique identifier | | `incidents.file` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":1,"created_at":"2021-01-08T17:20:07Z","updated_at":"2021-03-11T05:49:15Z","name":"test","assignee":"System Administrator","team":"Script Admins","description":"asdadad","investigation_field_values":[{"name":"Classification","value":"Malware"},{"name":"Severity","value":"Informational"},{"name":"Attack Vector","value":"Email"}],"in...` ## Get Single List Member Retrieves a specific member from a list in ProofPoint Threat Response using the provided list and member IDs. ### Endpoint - **URL:** `/api/lists/{{list_id}}/members/{{member_id}}.json` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.list_id` | number | Required | Parameters for the Get Single List Member action | | `path_parameters.member_id` | number | Required | Parameters for the Get Single List Member action | ### Input Example `{"path_parameters":{"list_id":2,"member_id":6}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `list_id` | number | Unique identifier | | `host_id` | number | Unique identifier | | `response_id` | object | Unique identifier | | `reverse_user_id` | object | Unique identifier | | `hash_reputation_id` | object | Unique identifier | | `user_id` | object | Unique identifier | | `enabled` | boolean | Output field: enabled | | `deleted` | boolean | Output field: deleted | | `description` | string | Output field: description | | `expiration` | object | Output field: expiration | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | | `host` | object | Output field: host | | `host.created_at` | string | Output field: host.created\_at | | `host.host` | string | Output field: host.host | | `host.id` | number | Unique identifier | | `host.resolution_state` | number | Output field: host.resolution\_state | | `host.ttl` | number | Output field: host.ttl | | `host.updated_at` | string | Output field: host.updated\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":6,"list_id":2,"host_id":6,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"test","expiration":null,"created_at":"2017-01-11T03:43:54Z","updated_at":"2017-01-11T03:43:54Z","host":{"created_at":"2016-12-29T04:56:13Z","host":"string","id":6,"resolution_st...` ## Ingest An Alert Ingest an alert into ProofPoint Threat Response using a specified source ID, with required path parameters and JSON body. ### Endpoint - **URL:** `/threat/json_event/events/{{json_source_id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.json_source_id` | string | Required | Parameters for the Ingest An Alert action | | `attacker` | object | Optional | Parameter for Ingest An Alert | | `attacker.host_name` | string | Optional | Name of the resource | | `attacker.ip_address` | string | Optional | Parameter for Ingest An Alert | | `attacker.port` | number | Optional | Parameter for Ingest An Alert | | `attacker.url` | string | Optional | URL endpoint for the request | | `attacker.user` | string | Optional | Parameter for Ingest An Alert | | `cnc_hosts` | array | Optional | Parameter for Ingest An Alert | | `cnc_hosts.host` | string | Optional | Parameter for Ingest An Alert | | `cnc_hosts.port` | number | Optional | Parameter for Ingest An Alert | | `detector` | object | Optional | Parameter for Ingest An Alert | | `detector.action` | string | Optional | Parameter for Ingest An Alert | | `detector.event_category` | string | Optional | Parameter for Ingest An Alert | | `detector.host_name` | string | Optional | Name of the resource | | `detector.ip_address` | string | Optional | Parameter for Ingest An Alert | | `detector.product` | string | Optional | Parameter for Ingest An Alert | | `detector.vendor` | string | Optional | Parameter for Ingest An Alert | | `email` | object | Optional | Parameter for Ingest An Alert | | `email.attachments` | array | Optional | Parameter for Ingest An Alert | | `email.attachments.content_type` | string | Optional | Type of the resource | | `email.attachments.date` | string | Optional | Date value | | `email.attachments.md5` | string | Optional | Parameter for Ingest An Alert | | `email.attachments.name` | string | Optional | Name of the resource | | `email.attachments.sha256` | string | Optional | Parameter for Ingest An Alert | | `email.attachments.size` | number | Optional | Parameter for Ingest An Alert | ### Input Example `{"json_body":{"json_version":"2.0","attacker":{"host_name":"evil.com","ip_address":"103.251.90.43","port":443,"url":"http://badurl.example.com","user":"user_id"},"classification":"Malware","cnc_hosts":[{"host":"cnc1.com","port":443},{"host":"cnc2.com","port":22}],"custom_fields":{"custom_field_1":"custom value string 1","custom_field_2":"custom value string 2","custom_field_3":"custom value string 3","custom_field_4":"custom value string 4","custom_field_5":"custom value string 5","custom_field_6":"custom value string 6"},"description":"A Description","detector":{"action":"Cleaned","event_category":"Malware","host_name":"siem.corp.domain.com","ip_address":"192.168.1.1","product":"SIEM product","vendor":"AwesomeSoft"},"email":{"attachments":[{"content_type":"JPEG","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment1.atch","sha256":"somesha256here","size":567},{"content_type":"HTML","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment2.atch","sha256":"somesha256here","size":567763}],"body":"some body text","body_type":"text","headers":{"foo":"bar","fooey":"barry"},"message_delivery_time":"2014-01-01T10:11:12Z","message_id":"abcdefg","recipient":"recipient@corp.com","sender":"sender@whatever.com","subject":"Click Me!","urls":["http://foo.com","https://bar.com/foobar/test?foo=5"]},"forensics_hosts":[{"host":"forensics1.com","port":80},{"host":"forensics2.com","port":443}],"link_attribute":"target_ip_address","severity":"medium","target":{"host_name":"host.yourdomain.com","ip_address":"10.10.111.111","mac_address":"01:23:45:67:89:ab","port":22,"url":"http://sample.example.com","user":"user_id"},"threat_info":{"filename":"malware.ppt","name":"Zeus","occurred_at":"2014-01-01T10:11:12Z","type":"Trojan"},"url":"http://www.badurl.com"},"path_parameters":{"json_source_id":"2"},"attacker":{"host_name":"evil.com","ip_address":"103.251.90.43","port":443,"url":"http://badurl.example.com","user":"user_id"},"cnc_hosts":[{"host":"cnc1.com","port":443},{"host":"cnc2.com","port":22}],"detector":{"action":"Cleaned","event_category":"Malware","host_name":"siem.corp.domain.com","ip_address":"192.168.1.1","product":"SIEM product","vendor":"AwesomeSoft"},"email":{"attachments":[{"content_type":"JPEG","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment1.atch","sha256":"somesha256here","size":567},{"content_type":"HTML","date":"2014-01-01T10:11:12Z","md5":"somemd5sumhere","name":"attachment2.atch","sha256":"somesha256here","size":567763}],"body":"some body text","body_type":"text","headers":{"foo":"bar","fooey":"barry"},"message_delivery_time":"2014-01-01T10:11:12Z","message_id":"abcdefg","recipient":"recipient@corp.com","sender":"sender@whatever.com","subject":"Click Me!","urls":["http://foo.com","https://bar.com/foobar/test?foo=5"]},"forensics_hosts":[{"host":"forensics1.com","port":80},{"host":"forensics2.com","port":443}],"target":{"host_name":"host.yourdomain.com","ip_address":"10.10.111.111","mac_address":"01:23:45:67:89:ab","port":22,"url":"http://sample.example.com","user":"user_id"},"threat_info":{"filehash":"77b63872fabf3884d694f694a2a87e2e","filename":"malware.ppt","name":"Zeus","occurred_at":"2014-01-01T10:11:12Z","type":"Trojan"},"custom_fields":{"custom_field_1":"custom value string 1","custom_field_2":"custom value string 2","custom_field_3":"custom value string 3","custom_field_4":"custom value string 4","custom_field_5":"custom value string 5","custom_field_6":"custom value string 6"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Update Incident Description Updates an incident's description in ProofPoint Threat Response using a specific incident ID. ### Endpoint - **URL:** `/api/incidents/{{incident_id}}/description.json` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ----------------------------------------------------- | | `path_parameters.incident_id` | number | Required | Parameters for the Update Incident Description action | | `description` | string | Optional | Parameter for Update Incident Description | | `overwrite` | string | Optional | Parameter for Update Incident Description | ### Input Example `{"json_body":{"description":"Handing off incident to threat research team","overwrite":"false"},"path_parameters":{"incident_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Update Member Of List Updates a specific member within a list using the provided list and member IDs in ProofPoint Threat Response. ### Endpoint - **URL:** `/api/lists/{{list_id}}/members/{{member_id}}.json` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.list_id` | number | Required | Parameters for the Update Member Of List action | | `path_parameters.member_id` | number | Required | Parameters for the Update Member Of List action | ### Input Example `{"path_parameters":{"list_id":2,"member_id":6}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `list_id` | number | Unique identifier | | `host_id` | number | Unique identifier | | `response_id` | object | Unique identifier | | `reverse_user_id` | object | Unique identifier | | `hash_reputation_id` | object | Unique identifier | | `user_id` | object | Unique identifier | | `enabled` | boolean | Output field: enabled | | `deleted` | boolean | Output field: deleted | | `description` | string | Output field: description | | `expiration` | string | Output field: expiration | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | | `host` | object | Output field: host | | `host.created_at` | string | Output field: host.created\_at | | `host.host` | string | Output field: host.host | | `host.id` | number | Unique identifier | | `host.resolution_state` | number | Output field: host.resolution\_state | | `host.ttl` | number | Output field: host.ttl | | `host.updated_at` | string | Output field: host.updated\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":4,"list_id":2,"host_id":4,"response_id":null,"reverse_user_id":null,"hash_reputation_id":null,"user_id":null,"enabled":true,"deleted":false,"description":"Hello PTR","expiration":"2017-12-03T10:15:30Z","created_at":"2016-12-29T01:52:33Z","updated_at":"2017-01-13T00:55:27Z","host":{"created_at":"2016-12-29T01:52:33Z","host":"7.7.7....` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | ----------------------------- | | content-length | The length of the response body in bytes | 140 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Wed, 23 Aug 2023 20:37:23 GMT |