What is Proofpoint TAP? #
Proofpoint Targeted Attack Protection (TAP) provides an innovative approach to detect, analyze, and block advanced email threats. TAP detects and blocks polymorphic malware, weaponized documents, credential phishing, and other advanced threats. TAP monitors cloud app activity to identify suspicious logins, broad file sharing, and risky third-party applications.
Why Should You Use the Proofpoint TAP Connector? #
The Proofpoint TAP connector provides visibility into the assets in your environment. You can use this visibility to:
- ensure assets are managed per your security policies
- derive relationships between assets, users, applications, and data
How Does This Connector Work? #
Meridian executes read-only requests to the Proofpoint TAP REST API and ingests only meta-data about Proofpoint TAP devices. Meridian does not retrieve any data stored on your assets.
Configuring the Connector in Meridian #
| Field | Description | Example |
|---|---|---|
| URL | The URL for the Proofpoint TAP API. | https://tap-api-v2.proofpoint.com |
| Principal Name | User name for a service account. Meridian will use this account to ingest data from Proofpoint TAP. For details, see https://ptr-docs.proofpoint.com/ptr-guides/integrations-files/ptr-tap/#generate-tap-service-credentials. | |
| Principal Secret | Password for a service account in Proofpoint. Meridian will use this account to ingest data from Proofpoint TAP. For details, see https://ptr-docs.proofpoint.com/ptr-guides/integrations-files/ptr-tap/#generate-tap-service-credentials. | |
| Data Lookback in Days | Number of days of data to ingest from Proofpoint TAP. Choices are:
| 30 |
Source Documentation #
Creating Credentials #
To create a service account and retrieve Principal Name and Principal Secret:
Required Permissions #
The Proofpoint TAP token must have read access to the People APIs. For details, see:
API Documentation #
https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/People_API
