Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Proofpoint Cloud Connector

Proofpoint Email Protection detects threats by processing email messages and protects against malware and cyber-attacks by offering multiple layers of security. It controls each aspect of inbound and outbound email to detect and block threats and- prevent leakage of confidential information. For more information visit Proofpoint’s website.

Supported Proofpoint Audit Sources and Events

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Event Included

ATP - SIEM

  • Messages delivered

  • Messages blocked

  • Clicks permitted

  • Clicks blocked

All

Proofpoint on Demand (PoD)

  • Mailog

  • Message

All

Prerequisites to Configure the Proofpoint Connector

Before you configure the Proofpoint connector you must obtain the following Proofpoint account information:

  • Service Principal and Service Principal Secret for the SIEM endpoint

  • Cluster ID and Access Token for Message and Maillog endpoints in the LogAPI endpoint group that are not included in the primary authentication data

To create an Access Token or credentials for Message and Maillog, contact Proofpoint support. Ensure that you have the license for Remote Syslog.

To obtain Proofpoint service principal and service principal secret string:

  1. Log in to the ProofPoint portal by accessing https://threatinsight.proofpoint.com/.

  2. Click the Settings icon in the upper right corner, then click Connected Applications.

  3. Click Create New Credential.

  4. Specify a name and click Generate.

  5. Record the Service Principal and Secret represented by a string of letters and numbers. Use these values to Configure the Proofpoint Cloud Connector.

Configure the Proofpoint Cloud Connector

Proofpoint Email Protection detects threats by processing email messages and protects against malware and cyber-attacks by offering multiple layers of security. It controls each aspect of inbound and outbound email to detect and block threats and- prevent leakage of confidential information. For more information visit Proofpoint’s website.

To configure the Proofpoint Connector to import data into Exabeam Cloud Connector Platform:

  1. Complete the Prerequisites to Configure the Proofpoint Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select Proofpoint from the list.

  5. In the Accounts section, enter the required information. Required fields are indicated with a red bar.

    1. Account Name – Specify a name for the cloud connector. For example, Corporate Proofpoint.

    2. Description – (Optional) Describe the Proofpoint account.

    3. Service Principal – Enter the value for the service principal that you obtained while completing prerequisites.

    4. Secret – Enter the value for the secret that you obtained while completing prerequisites.

    5. Cluster ID – (Maillog and Message endpoints only) Enter the value for the cluster ID that you obtained while completing prerequisites.

    6. Access Token – (Maillog and Message endpoints only) Enter the value for the access token that you obtained while completing prerequisites.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.