Proofpoint ThreatProtection integration content-pack. #35270

ahopstetter-sce · 2024-07-05T19:47:34Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

Ready (For review and merge)

Description

This is a new XSOAR content-pack contribution containing the XSOAR commands necessary to interact with the Proofpoint ThreatProtection API.

Related Issues

fixes: link to the issue

Must have

Tests
Documentation

CLAassistant · 2024-07-05T19:47:40Z

All committers have signed the CLA.

thefrieddan1 · 2024-07-07T09:38:59Z

@ahopstetter-sce Thank you for your contribution.
The level of the code and test cover is indeed in XSOAR support level.
I do have a comment about the test,
There is usage of uvicorn server on http:// and port 8000
On which XSOAR server did you test it? Or did you test it only locally?
On XSOAR8 and XSIAM its not possible for integration (unless privileged system integrations) to spin up an internal server with a dedicated port on localhost. (It is a change from XSAOR6).
This is due to the move to hosted servers on GCP.
Please change the test to be without an internal server so it will run on our build machines.
To do so you can mock the responses from client without actually reaching a server.

Please let me know what you think.
Thanks.

ShirleyDenkberg · 2024-07-07T09:24:06Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+  name: cluster_id
+  required: true
+  type: 0
+description: Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.


Suggested change

description: Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

description: Threat Protection APIs are REST APIs that allow Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

ShirleyDenkberg · 2024-07-07T09:24:59Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      - add
+      - delete
+      required: true
+      description: add or delete.


Suggested change

description: add or delete.

description: The action to perform.

ShirleyDenkberg · 2024-07-07T09:25:13Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      - $helo
+      - $rcpt
+      required: true
+      description: Supported Attributes for the Organizational Safe List.


Suggested change

description: Supported Attributes for the Organizational Safe List.

description: Supported attributes for the Organizational Safe List.

Is this for the Safe List or the Block list?

ShirleyDenkberg · 2024-07-07T09:25:24Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      - contain
+      - not_contain
+      required: true
+      description: Supported Operators for the Organizational Safe List.


Suggested change

description: Supported Operators for the Organizational Safe List.

description: Supported operators for the Organizational Safe List.

Is this for the Safe List or the Block List?

ShirleyDenkberg · 2024-07-07T09:30:05Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      - not_contain
+      required: true
+      description: Supported Operators for the Organizational Safe List.
+    - description: Entry to be added to list.


Which list? Safe List or Block List?
Please specify.

ShirleyDenkberg · 2024-07-07T09:40:58Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+
+Use the key and secret generated from the Admin Portal ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) to generate an authentication token. The token is valid for 1 hour.
+
+Click the <b>+Create New</b> button to display the <b>Create New Threat Protection API Key</b> dialog box for the cluster. Add a descriptive name for the key. The Cluster ID and Expiration Date for the key display in the dialog box. Keys are valid for one year from the date they are generated. Click <b>Generate Key</b> to create the key and secret.


Suggested change

Click the +Create New button to display the Create New Threat Protection API Key dialog box for the cluster. Add a descriptive name for the key. The Cluster ID and Expiration Date for the key display in the dialog box. Keys are valid for one year from the date they are generated. Click Generate Key to create the key and secret.

1. Click +Create New. The Create New Threat Protection API Key dialog box for the cluster appears.

2. Add a descriptive name for the key.

3. Click Generate Key to create the key and secret.

4. The Create New Threat Protection API Key dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. You will need the key and secret to obtain the authentication token for the API service.

The Cluster ID and Expiration Date for the key display in the dialog box. Keys are valid for one year from the date they are generated.

ShirleyDenkberg · 2024-07-07T09:41:43Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+Use the key and secret generated from the Admin Portal ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) to generate an authentication token. The token is valid for 1 hour.
+
+Click the <b>+Create New</b> button to display the <b>Create New Threat Protection API Key</b> dialog box for the cluster. Add a descriptive name for the key. The Cluster ID and Expiration Date for the key display in the dialog box. Keys are valid for one year from the date they are generated. Click <b>Generate Key</b> to create the key and secret.
+- <b>Note</b>: Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to <b>Renew</b> it before permanently expiring it.


Suggested change

- Note: Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to Renew it before permanently expiring it.

- Note: The Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to Renew it before permanently expiring it.

ShirleyDenkberg · 2024-07-07T09:44:35Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+---
+View Integration Documentation


Suggested change

---

View Integration Documentation

ShirleyDenkberg · 2024-07-07T09:48:47Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+- <b>Note</b>: Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to <b>Renew</b> it before permanently expiring it.
+- The ellipsis menu for each key provides two choices: <b>Renew</b> and <b>Revoke</b>. <b>Renew</b> will extend the key expiration for one more year. <b>Revoke</b> will permanently remove the key and it cannot be restored.
+
+The <b>Create New Threat Protection API Key</b> dialog box displays the key and secret for the currently-selected cluster. Copy the API key and Secret to the clipboard by clicking the page icon next to each and store these in a safe place. The Secret will not be visible once you close this dialog box. <b>You will need the key and secret to obtain the authentication token for the API service</b>.


Suggested change

The Create New Threat Protection API Key dialog box displays the key and secret for the currently-selected cluster. Copy the API key and Secret to the clipboard by clicking the page icon next to each and store these in a safe place. The Secret will not be visible once you close this dialog box. You will need the key and secret to obtain the authentication token for the API service.

ShirleyDenkberg · 2024-07-07T10:21:35Z

Packs/ProofpointThreatProtection/README.md

@@ -0,0 +1,3 @@
+# Proofpoint Threat Protection
+
+Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.


Suggested change

Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

Threat Protection APIs are REST APIs that allow Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

ShirleyDenkberg · 2024-07-07T10:22:38Z

@ahopstetter-sce After implementing my comments/edits in the yml file, please regenerate the integration readme.
@thefrieddan1 Doc review completed.

…bling full client mock code if uvicorn run fails on load.

ahopstetter-sce · 2024-07-08T18:15:46Z

@ahopstetter-sce Thank you for your contribution. The level of the code and test cover is indeed in XSOAR support level. I do have a comment about the test, There is usage of uvicorn server on http:// and port 8000 On which XSOAR server did you test it? Or did you test it only locally? On XSOAR8 and XSIAM its not possible for integration (unless privileged system integrations) to spin up an internal server with a dedicated port on localhost. (It is a change from XSAOR6). This is due to the move to hosted servers on GCP. Please change the test to be without an internal server so it will run on our build machines. To do so you can mock the responses from client without actually reaching a server.

Please let me know what you think. Thanks.

Hello @thefrieddan1 ,

I've added code to test load up the uvicorn server at module load time ... and upon failure .... the code reverts back to full client pytest.mocking responses. Previously only fastapi module load was tested at module load time, but the updated code actually test loads the binding of tcp port 8000 on the loopback. So that should fly on your test servers! :)

Adam

ahopstetter-sce · 2024-07-08T18:17:49Z

@ahopstetter-sce After implementing my comments/edits in the yml file, please regenerate the integration readme. @thefrieddan1 Doc review completed.

@ShirleyDenkberg ,

Thanks for your doc updates. I honestly upon review thought the _description.md file needed an almost complete redo. You may want to double check that one. Thanks! :)

Adam

…nd_randomizerxd-ProofpointThreatProtection' into xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection

ShirleyDenkberg · 2024-07-09T03:38:54Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+
+### Proofpoint Threat Protection Integration Setup
+
+To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.


Suggested change

To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

To set up the Proofpoint Threat Protection API Corrtex XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

I'm assuming Corrtex here should be Cortex @ShirleyDenkberg

ShirleyDenkberg · 2024-07-09T03:39:43Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+#### To Create a new Threat Protection API Key
+
+1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.
+2. Click <b>+Create New</b>. The <b>Create New Threat Protection API Key</b> dialog box for the cluster appears.


Suggested change

2. Click +Create New. The Create New Threat Protection API Key dialog box for the cluster appears.

2. Click **+Create New**. The Create New Threat Protection API Key dialog box for the cluster appears.

ShirleyDenkberg · 2024-07-09T03:40:31Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+2. Click <b>+Create New</b>. The <b>Create New Threat Protection API Key</b> dialog box for the cluster appears.
+3. Add a descriptive name for the key. 
+4. Click <b>Generate Key</b> to create the key and secret.
+5. The <b>Create New Threat Protection API Key</b> dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. <b>You will need the key and secret to obtain the authentication token for the API service</b>.


Suggested change

5. The Create New Threat Protection API Key dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. You will need the key and secret to obtain the authentication token for the API service.

5. The Create New Threat Protection API Key dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. You will need the key and secret to obtain the authentication token for the API service.

ShirleyDenkberg · 2024-07-09T03:40:47Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+
+#### To Manage previously generated Threat Protection API Keys
+
+1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.


Suggested change

1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.

1. In the Proofpoint Admin Portal, navigate to the API Key Management section.

ShirleyDenkberg · 2024-07-09T03:41:50Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+
+To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.
+
+#### To Create a new Threat Protection API Key


Suggested change

#### To Create a new Threat Protection API Key

#### To Create a New Threat Protection API Key

ShirleyDenkberg · 2024-07-09T03:42:05Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+4. Click <b>Generate Key</b> to create the key and secret.
+5. The <b>Create New Threat Protection API Key</b> dialog box displays the key and secret for the currently-selected cluster. Click the page icon next to each cluster to copy the API key and Secret to the clipboard and store them in a safe place. The Secret will not be visible once you close this dialog box. <b>You will need the key and secret to obtain the authentication token for the API service</b>.
+
+#### To Manage previously generated Threat Protection API Keys


Suggested change

#### To Manage previously generated Threat Protection API Keys

#### To Manage Previously Generated Threat Protection API Keys

ShirleyDenkberg · 2024-07-09T03:42:41Z

...Protection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection_description.md

+#### To Manage previously generated Threat Protection API Keys
+
+1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.
+2. For each API key previously generated there is an ellipsis providing two choices of action: <b>Renew</b> and <b>Revoke</b>.


Suggested change

2. For each API key previously generated there is an ellipsis providing two choices of action: Renew and Revoke.

2. For each API key previously generated there is an ellipsis providing two choices of action: Renew and Revoke. Select the action as needed.

ShirleyDenkberg · 2024-07-09T03:44:33Z

@ahopstetter-sce I reviewed the description file again. See my edits.

ahopstetter-sce · 2024-07-09T16:26:04Z

@ahopstetter-sce I reviewed the description file again. See my edits.

These edits have been committed and pushed. @ShirleyDenkberg

…nd_randomizerxd-ProofpointThreatProtection' into xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection

content-bot · 2024-07-10T12:03:36Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/1165178

...fpointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.py

content-bot · 2024-07-16T11:23:07Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2024-07-16T11:23:11Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/1181485

thefrieddan1

Hi @ahopstetter-sce
Thanks again for your contribution.
Here are the comments in accordance to the design doc:

Separate the command add-or-delete into 2 different commands.
Rename the get commands to list.
Add pagination to the list commands.

thefrieddan1 · 2024-07-22T12:47:37Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+  commands:
+  - arguments: []
+    description: Get all entries in the Organizational Block List.
+    name: proofpoint-tp-blocklist-get


proofpoint-tp-blocklist-list
API: GET /api/v1/emailProtection/modules/spam/ orgBlockList?clusterId=
description: Get all entries in the Organizational Block List
Args:
ArgumentName: page Type: integer isArray: No Required: No
ArgumentName: page_size Type: integer isArray: No Required: No defualtValue: 50 Notes: number of issues per page.
ArgumentName: limit Type: integer isArray: No Required: No defualtValue: is 25 maximum is 100 the number of items to be present in the response

Context output base path: ProofpointThreatProtection.Blocklist
Outputs: Full API response should be returned as output

thefrieddan1 · 2024-07-22T12:49:05Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      required: true
+    - description: A short comment about the entry (max 150 chars). "comment" is ignored for the "delete" action.
+      name: comment
+    description: Add/Delete entry from the Organizational Block List.


Separate the command add-or-delete into 2 different commands.

thefrieddan1 · 2024-07-22T12:52:59Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      description: Standard HTTP response with status code 200.
+  - arguments: []
+    description: Get all entries in the Organizational Safe List.
+    name: proofpoint-tp-safelist-get


proofpoint-tp-safelist-list
API: GET /api/v1/emailProtection/modules/spam/orgSafeList?clusterId=
Arguments:
ArgumentName: page, PossibleValues: Integer, IsArray: No, Required: No
ArgumentName: page_size, PossibleValues: Integer, IsArray: No, Required: No, DefaultValue: 50, Note: number of issued per page(optional)
ArgumentName: Integer, PossibleValues: Integer, IsArray: No, Required: No, DefaultValue: default is 25 maximum is 100, Note: the number of items to be present in the response.
Context output base path: ProofpointThreatProtection.Safelist
Outputs: Full API response should be returned as output

thefrieddan1 · 2024-07-22T12:59:33Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+    - description: A short comment about the entry (max 150 chars). "comment" is ignored for the "delete" action.
+      name: comment
+    description: Add/Delete entry from the Organizational Block List.
+    name: proofpoint-tp-blocklist-add-or-delete-entry


proofpoint-tp-safelist-add-entry
API: POST /api/v1/emailProtection/modules/spam/orgSafeList?clusterId=
Inputs:
ArgumentName: action, PossibleValues: String:add, IsArray: No, Required: Yes, defaultValue: add, Note: (hardcoded not an arg)
ArgumentName: attribute, PossibleValues: String:from, hfrom, ip, host, help, rcpt, IsArray: No, Required: Yes, Note: See Table 1 (page 4)
ArgumentName: operator, PossibleValues: String: equal, not_equal, contain, not_contain, IsArray: No, Required: Yes, Note: See Table 1 (page 4)
ArgumentName: value, PossibleValues: String, IsArray: No, Required: Yes, Note: Entry to be added to list
ArgumentName: comment, PossibleValues: String, IsArray: No, Required: No, Note: A short comment about the entry (max 150 chars).

thefrieddan1 · 2024-07-22T13:05:26Z

...pointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.yml

+      name: comment
+    description: Add/Delete entry from the Organizational Block List.
+    name: proofpoint-tp-blocklist-add-or-delete-entry
+    outputs:


proofpoint-tp-blocklist-delete-entry
API: POST /api/v1/emailProtection/modules/spam/orgBlockList?clusterId=
Inputs:
ArgumentName: action, PossibleValues: String:delete, IsArray: No, Required: Yes, defaultValue: delete, Note: (hardcoded not an arg)
ArgumentName: attribute, PossibleValues: String:from, hfrom, ip, host, help, rcpt, IsArray: No, Required: Yes, Note: See Table 2 (page 8)
ArgumentName: operator, PossibleValues: String: equal, not_equal, contain,not_contain, IsArray: No, Required: Yes, defaultValue: add, Note: See Table 2 (page 8)
ArgumentName: value, PossibleValues: String, IsArray: No, Required: Yes, Note: Entry to be added to list

thefrieddan1 · 2024-08-04T11:12:14Z

Hi @ahopstetter-sce
I didnt hear from you after my comments on your contribution.
Please let me know if there is anything I can help with?

Thanks

RotemAmit · 2024-08-11T08:47:17Z

Hi @ahopstetter-sce,
we haven’t heard from you in a while.
Do you need any help with the pull request?
Please feel free to reach out to @DeanArbel or me here or on Slack.
Thanks again for contributing to our repo, we really appreciate your effort as part of this contribution, but we want to release this pack to the marketplace soon, so unless you answer by August 13th, we will close the contribution and continue the development as an inside effort.

ahopstetter-sce · 2024-08-13T17:23:37Z

Hi @ahopstetter-sce Thanks again for your contribution. Here are the comments in accordance to the design doc:

Separate the command add-or-delete into 2 different commands.

Rename the get commands to list.

Add pagination to the list commands.

Hey @thefrieddan1 .... sorry for the delayed response ..... yea I will get to work on these modifications for you ASAP ..... I was out for the last couple of weeks with a personal issue that suddently dominated my world but am over that now .... so in regaining focus I will get these items on my radar and work them to conclusion and get them pushed up as soon as humanly possible! :D Thanks!

…n readable returns.

ahopstetter-sce · 2024-08-20T17:58:32Z

Hi @ahopstetter-sce I didnt hear from you after my comments on your contribution. Please let me know if there is anything I can help with?

Thanks

Hey @thefrieddan1 .... I have all the requested changes implemented save one .... which is pagination ... are we implementing this in integrations where the underlying API does NOT support .... and only supports fetching the entire list in an API operation .... seems like an utter abuse of resources to implement a lipstick style client side pagination interface only to front end multiple "get all" calls to the API server-side? Is this what xsoar is desiring here?

ahopstetter-sce · 2024-08-22T19:53:32Z

All requested items have been completed, commited and pushed.

…ands.

github-actions · 2024-08-25T12:32:40Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* Proofpoint ThreatProtection integration content-pack. (#35270) * Proofpoint ThreatProtection integration content-pack. * Updates to pass XSOAR Circle-CI validation checks. * Documentation review updates. * Added pre-emptive testload of uvicorn server at pytest load time, enabling full client mock code if uvicorn run fails on load. * Updates to the description.md. * Bugfixs for auth headers. * Rename get commands to list, split add/delete commands and fixup human readable returns. * Added limit and all_results arguments to list commands. * Fixed up the yaml file and updated the tests file to reflect new commands. * change url display name * add integration to conf.json * revert conf.json changes. --------- Co-authored-by: Danny_Fried <[email protected]> * update conf.json * bump docker image. --------- Co-authored-by: ahopstetter-sce <[email protected]> Co-authored-by: Danny_Fried <[email protected]>

* Proofpoint ThreatProtection integration content-pack. (demisto#35270) * Proofpoint ThreatProtection integration content-pack. * Updates to pass XSOAR Circle-CI validation checks. * Documentation review updates. * Added pre-emptive testload of uvicorn server at pytest load time, enabling full client mock code if uvicorn run fails on load. * Updates to the description.md. * Bugfixs for auth headers. * Rename get commands to list, split add/delete commands and fixup human readable returns. * Added limit and all_results arguments to list commands. * Fixed up the yaml file and updated the tests file to reflect new commands. * change url display name * add integration to conf.json * revert conf.json changes. --------- Co-authored-by: Danny_Fried <[email protected]> * update conf.json * bump docker image. --------- Co-authored-by: ahopstetter-sce <[email protected]> Co-authored-by: Danny_Fried <[email protected]>

Proofpoint ThreatProtection integration content-pack.

2375ff7

content-bot added Contribution Thank you! Contributions are always welcome! External PR Xsoar Support Level Indicates that the contribution is for XSOAR supported pack labels Jul 5, 2024

content-bot changed the base branch from master to contrib/ahopstetter-sce_xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection July 5, 2024 19:48

content-bot assigned israelpoli Jul 5, 2024

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels Jul 5, 2024

Updates to pass XSOAR Circle-CI validation checks.

0723d3f

thefrieddan1 assigned thefrieddan1 and unassigned israelpoli Jul 7, 2024

thefrieddan1 self-requested a review July 7, 2024 07:48

thefrieddan1 mentioned this pull request Jul 7, 2024

[Marketplace Contribution] Proofpoint Threat Protection #33712

Closed

4 tasks

thefrieddan1 assigned ShirleyDenkberg Jul 7, 2024

thefrieddan1 requested a review from ShirleyDenkberg July 7, 2024 08:57

ShirleyDenkberg reviewed Jul 7, 2024

View reviewed changes

ShirleyDenkberg added the docs-approved label Jul 7, 2024

ahopstetter-sce added 2 commits July 8, 2024 10:40

Documentation review updates.

331b28f

Added pre-emptive testload of uvicorn server at pytest load time, ena…

224d8b9

…bling full client mock code if uvicorn run fails on load.

Merge branch 'contrib/ahopstetter-sce_xsoar-contrib_ahopstetter-sce_a…

533a231

…nd_randomizerxd-ProofpointThreatProtection' into xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection

ShirleyDenkberg reviewed Jul 9, 2024

View reviewed changes

Updates to the description.md.

f675770

Merge branch 'contrib/ahopstetter-sce_xsoar-contrib_ahopstetter-sce_a…

3e064a0

…nd_randomizerxd-ProofpointThreatProtection' into xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Jul 10, 2024

thefrieddan1 reviewed Jul 10, 2024

View reviewed changes

...fpointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.py Show resolved Hide resolved

...fpointThreatProtection/Integrations/ProofpointThreatProtection/ProofpointThreatProtection.py Show resolved Hide resolved

thefrieddan1 added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Jul 16, 2024

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Jul 16, 2024

thefrieddan1 requested changes Jul 22, 2024

View reviewed changes

ahopstetter-sce added 2 commits August 20, 2024 10:24

Bugfixs for auth headers.

c3c36fc

Rename get commands to list, split add/delete commands and fixup huma…

c0470be

…n readable returns.

thefrieddan1 and others added 2 commits August 21, 2024 13:58

Merge branch 'master' into pr/ahopstetter-sce/35270

ddb7dd6

Added limit and all_results arguments to list commands.

2281d50

Fixed up the yaml file and updated the tests file to reflect new comm…

de7cda4

…ands.

thefrieddan1 approved these changes Aug 25, 2024

View reviewed changes

thefrieddan1 added 2 commits August 25, 2024 12:16

change url display name

53a7d44

add integration to conf.json

1df7be5

thefrieddan1 requested a review from sapirshuker as a code owner August 25, 2024 12:02

thefrieddan1 added 2 commits August 25, 2024 15:07

Merge branch 'master' into pr/ahopstetter-sce/35270

adad107

revert conf.json changes.

23fc911

thefrieddan1 merged commit dfb547c into demisto:contrib/ahopstetter-sce_xsoar-contrib_ahopstetter-sce_and_randomizerxd-ProofpointThreatProtection Aug 25, 2024
15 of 16 checks passed

content-bot mentioned this pull request Aug 25, 2024

Proofpoint ThreatProtection integration content-pack. #36009

Merged

3 tasks

	description: Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.
	description: Threat Protection APIs are REST APIs that allow Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.

	description: add or delete.
	description: The action to perform.

	description: Supported Attributes for the Organizational Safe List.
	description: Supported attributes for the Organizational Safe List.

	description: Supported Operators for the Organizational Safe List.
	description: Supported operators for the Organizational Safe List.


		Use the key and secret generated from the Admin Portal ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) to generate an authentication token. The token is valid for 1 hour.

		Click the <b>+Create New</b> button to display the <b>Create New Threat Protection API Key</b> dialog box for the cluster. Add a descriptive name for the key. The Cluster ID and Expiration Date for the key display in the dialog box. Keys are valid for one year from the date they are generated. Click <b>Generate Key</b> to create the key and secret.

	- <b>Note</b>: Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to <b>Renew</b> it before permanently expiring it.
	- <b>Note</b>: The Threat Protection API will honor the key and secret for a 7-day grace period when it expires to give you a chance to <b>Renew</b> it before permanently expiring it.

		@@ -0,0 +1,3 @@
		# Proofpoint Threat Protection

		Threat Protection APIs are REST APIs that allow our Proofpoint On Demand customers to retrieve, add, update or delete certain PoD configurations.


		### Proofpoint Threat Protection Integration Setup

		To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

	To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.
	To set up the Proofpoint Threat Protection API Corrtex XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

	2. Click <b>+Create New</b>. The <b>Create New Threat Protection API Key</b> dialog box for the cluster appears.
	2. Click +Create New. The Create New Threat Protection API Key dialog box for the cluster appears.


		#### To Manage previously generated Threat Protection API Keys

		1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.

	1. From within the Proofpoint Admin Portal, navigate to the API Key Management section.
	1. In the Proofpoint Admin Portal, navigate to the API Key Management section.


		To setup the Proofpoint Threat Protection API XSOAR integration, a Threat Protection API Key and its associated secret must be configured, along with the associated Proofpoint clusterID. ([See API Key Management](https://help.proofpoint.com/Admin_Portal/Settings/API_Key_Management)) for more information regarding Proofpoint Threat Protection API key generation and management.

		#### To Create a new Threat Protection API Key

	2. For each API key previously generated there is an ellipsis providing two choices of action: <b>Renew</b> and <b>Revoke</b>.
	2. For each API key previously generated there is an ellipsis providing two choices of action: <b>Renew</b> and <b>Revoke</b>. Select the action as needed.

Proofpoint ThreatProtection integration content-pack. #35270

Proofpoint ThreatProtection integration content-pack. #35270

Conversation

ahopstetter-sce commented Jul 5, 2024 • edited by thefrieddan1 Loading

Contributing to Cortex XSOAR Content

Status

Description

Related Issues

Must have

CLAassistant commented Jul 5, 2024 • edited Loading

thefrieddan1 commented Jul 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ShirleyDenkberg commented Jul 7, 2024

ahopstetter-sce commented Jul 8, 2024 • edited Loading

ahopstetter-sce commented Jul 8, 2024 • edited Loading

Choose a reason for hiding this comment

ahopstetter-sce Jul 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ShirleyDenkberg commented Jul 9, 2024

ahopstetter-sce commented Jul 9, 2024 • edited Loading

content-bot commented Jul 10, 2024

content-bot commented Jul 16, 2024

content-bot commented Jul 16, 2024

thefrieddan1 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thefrieddan1 commented Aug 4, 2024

RotemAmit commented Aug 11, 2024

ahopstetter-sce commented Aug 13, 2024

ahopstetter-sce commented Aug 20, 2024 • edited Loading

ahopstetter-sce commented Aug 22, 2024

github-actions bot commented Aug 25, 2024

ahopstetter-sce commented Jul 5, 2024 •

edited by thefrieddan1

Loading

CLAassistant commented Jul 5, 2024 •

edited

Loading

ahopstetter-sce commented Jul 8, 2024 •

edited

Loading

ahopstetter-sce commented Jul 8, 2024 •

edited

Loading

ahopstetter-sce Jul 9, 2024 •

edited

Loading

ahopstetter-sce commented Jul 9, 2024 •

edited

Loading

ahopstetter-sce commented Aug 20, 2024 •

edited

Loading