Proofpoint On Demand Email Security App
Overview
Details
• Delivers visibility into today’s advanced attacks such as ransomware, business email compromise (BEC), impostor, and credential phishing attacks
• Automates sending of Email filtering and routing logs from Proofpoint On Demand to Splunk Enterprise from one or many sources
• Provides visibility into email activity, threats and data exfiltration by attackers and malicious insiders
• Consolidates reporting and provides comprehensive visibility by correlating email and other data sources in Splunk.
Copyright (c) 2010-2019 by Proofpoint, Inc. All Rights Reserved.
Proofpoint On Demand, Proofpoint Protection Server and the Proofpoint logos are trademarks or registered trademarks of Proofpoint, Inc.
Proofpoint On Demand Email Security App
| About | Proofpoint On Demand Email Security App |
| Developer | Proofpoint, Inc. |
| App Version | 2.1.0 |
| App Build | 57 |
| Technology Add-on (TA) | Proofpoint On Demand Email Security Add On |
| Technology Add-on (TA) | Proofpoint TAP SIEM Modular Input |
| Folder Name | pps_ondemand |
| Vendor Products | Proofpoint On Demand 8.0 and above |
| Target Attack Protection | |
| Has index-time operations | False |
| Create an index | False |
| Implements summarization | False |
| Splunk Enterprise versions | 9.0, 8.2, 8.1 |
| CIM | 4.8+ |
| Platforms | Platform Independent |
| Requires Splunk Restart | Yes |
Installation and Configuration
Pre-requisites
- Splunk Enterprise (9.0, 8.2, 8.1).
- Splunk Common Integration Model technology add-on 4.8 or above.
- Proofpoint On Demand Email Security Add On available on Splunkbase (#4327)
Proofpoint Products
- Proofpoint On Demand 8.0 and above with PoD Log API access
- Target Attack Protection API access with API Service account and secret key
Product Configuration
- Proofpoint on Demand (PoD): PoD Log API service requires Remote Syslog Forwarding license. Please refer this document on how to enable and check PoD Log API: https://proofpointcommunities.force.com/community/s/article/Proofpoint-on-Demand-Pod-Log-API
Deployment
Single Server Deployment:
In a single server deployment, single instance of Splunk Enterprise functions as data collection node, indexer and search head. In such deployment, install the add-ons Proofpoint Email Security Add-On and Proofpoint TAP SIEM Modular Input. After that, install Proofpoint Email Security App For Splunk.
Distributed Deployment
In a distributed deployment, typically a combination of forwarders are deployed for data collection, separate indexer nodes for data ingestion and search heads for data visualization are deployed. We recommend installing our Add-Ons on both Forwarder and Search heads and the App on the search head.
| Component | Forwarder | Indexer | Search head |
| Proofpoint On Demand Email Security Add-on | Install | No (Note) | Install |
| Proofpoint TAP SIEM Modular Input 1.0.1 available (TA) | Install | No (Note) | Install |
| Proofpoint On Demand Email Security App | No | No | Install |
Note: When there is no forwarder, you will have to install the Add-on on Indexer.
Proofpoint On Demand Email Security App Configuration
Changing the Index
By default this app uses the "main" index to look for Proofpoint logs. To change this to an index that the Proofpoint On Demand Email Security Add-on uses, you need to edit the pps_get_index macro. Here are the steps:
- Navigate to Settings->Advanced Search and select "Search macros"
- Change the app context to "Proofpoint On Demand Email Security App"
- Select the macro named "pps_get_index"
- Change index=main to the correct index. Please make sure this index matches the one used by the Proofpoint On Demand Email Security Add-on.
- Save the configuration.
Accelerate the Data Model
By default, the data model acceleration is not enabled. You need to enable this to make sure the dashboards show the realtime data.
- Login to Splunk as admin and select Settings then Data Model.
- Make sure to select "Proofpoint On Demand Email Security App" app context.
- On "Proofpoint On Demand Email Security Data Model", click the "Edit" and select "Edit Acceleration"
- Select the "Accelerate" checkbox.
- For "Summary Range" select week, month, year or all time depending on how much data you would like to see on the dashboard.
- Save the configuration
Verification
Note: Please wait few minutes after the changing the Acceleration settings to check the dashboard.
- To view the dashboards from the splunk home page, click on the Proofpoint On Demand Email Security App" icon. This should take you to Proofpoint Email Security Dashboard with latest stats.
- Explore the built-in "Message Summary" tab that can be used to find a given email.
- The "TLS Dashboard" tab shows the connections that were using TLS and also lists the domains not using TLS.
- Explore the "Reports" tabs for various built-in reports.
Release Notes
Version 2.1.0
Updated the dashboards to use jquery version 3.5
Version 2.0.0
Updates in 2.0.0 release
1. Support for Splunk 8 with compatibility for both Python 2 and 3.
2. Minor changes to TLS dashboard.
3. Proofpoint Icon updated according to recent branding changes.
4. CIM mapping changes
Version 1.0.0
Version 1.0.0
Dec. 17, 2018
This App is designed to work with Proofpoint On Demand Email Security Add On.