Proofpoint SIEM Actions

Actions for Proofpoint SIEM #

• Send Data to Proofpoint SIEM. Sends a custom set of Lucidum data to Proofpoint SIEM.

Use Cases #

Below are the possible use cases for these actions:

• If you want to run Lucidum “headless”, you can send relevant data to Proofpoint SIEM on a regular schedule.

• You can send normalized, enriched Lucidum data to Proofpoint SIEM to be indexed, searched, and analyzed.

Prerequisites #

To execute Proofpoint SIEM actions, you must configure a Proofpoint SIEM API connection beforehand.

Workflows #

• Creating a new Configuration and a new Action
• Cloning an Existing Action
• Creating a new Action from the Location Results page
• Editing a Configuration
• Editing an Action
• Viewing Information about an Action

Proofpoint SIEM Configuration #

To create a configuration for Proofpoint SIEM actions:

• Configuration Name. Identifier for the Configuration. This name will appear in the Lucidum Action Center.

• URL. The URL of the Proofpoint SIEM API, for example, https://tap-api-v2.proofpoint.com/v2/siem/

• Principal. The service principal and secret are used to authenticate to the SIEM API. They are generated on the settings page of the Threat Insight Dashboard. To find the service principal:

  1. Log in to your Proofpoint console and navigate to the Threat Insight Dashboard.
  2. Navigate to the Settings page.
  3. Locate your Service Principal and Secret and save them locally.

• Secret. The service principal and secret are used to authenticate to the SIEM API. They are generated on the settings page of the Threat Insight Dashboard. To find the service principal:

  1. Log in to your Proofpoint console and navigate to the Threat Insight Dashboard.
  2. Navigate to the Settings page.
  3. Locate your Service Principal and Secret and save them locally.

• Max # of Records per Payload. The maximum number of records to send to Proofpoint SIEM in each action. The default value is “50”.

Manage Action Token #

To describe an action token for Proofpoint SIEM actions:

1. Click the token icon.

2. In the Manage Action Tokens page, click the plus-sign in the upper right.

Create a New Action #

To create an action for Proofpoint SIEM, contact Lucidum customer care.