icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Proofpoint Email Security Add-On for Splunk
SHA256 checksum (proofpoint-email-security-add-on-for-splunk_108.tgz) 911a7815b52278c55a63605324ed938c51df76554e95b49d4406c96bf462c2c3 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_107.tgz) 1445361d0f019dafcae977998afcc0b672d01a39a8bab02e51f804783d60e605 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_106.tgz) 76f19d9eec0b97f2ca1c94b137d39ab1422e2d44e3f04fefa188da13bdfb04d5 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_105.tgz) b319793b52a2cdfdf9037603f504c0fc3777c909e2617a8afca55577e503021b SHA256 checksum (proofpoint-email-security-add-on-for-splunk_104.tgz) b8293b245505b434183d86e141a2051b99a51811a48a15a5cfb4b1f5a3d29270 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_103.tgz) 0589d8d4656c65f30a9c6d29f6b6d4463eb535ba5e8080ad6369e07964f8ee45 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_102.tgz) 36df977a334ef4e0f226fd1e19d8622dc4c01905190b7f580bfbc8016e9ccb98 SHA256 checksum (proofpoint-email-security-add-on-for-splunk_101.tgz) a7aa99b5ee29be6ea7b11217f812634e2b6bef1a9170e692ac95c118c423f82f SHA256 checksum (proofpoint-email-security-add-on-for-splunk_100.tgz) 16ac592089f257128abe94567c0de227fe4f1f26806bf8e4d26fb31ee699c07f
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Proofpoint Email Security Add-On for Splunk

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
Customers interested in integrating Proofpoint Protection Server (PPS) logs with Splunk can utilize this custom-built add-on. This technology add-on focuses on normalizing the filter logs based on the Splunk Common Information Model (CIM) for email.

By normalizing filtering data produced by PPS to CIM-compliant Email data model, Splunk users can perform search, report or other operations they have built using the Email data model against PPS filtering data without further customizations, which eliminates the need to understand PPS filtering data format.

Copyright (c) 2010-2017 by Proofpoint, Inc. All Rights Reserved.

Proofpoint, Proofpoint Protection Server and the Proofpoint logos are trademarks or registered trademarks of Proofpoint, Inc.

Proofpoint Email Security Add-On For Splunk

About Proofpoint Email Security Add-On for Splunk
Developer Proofpoint, Inc.
App Version 1.0.8
App Build 17
App Proofpoint Email Security App for Splunk
Technology Add-on (TA) Proofpoint TAP SIEM Modular Input
Folder Name TA_pps
Vendor Products Proofpoint Enterprise Protection 8.0 and above
Proofpoint On Demand 8.0 and above
Has index-time operations True
Create an index False
Implements summarization False
Splunk Enterprise versions 6.4, 6.5, 6.6
CIM 4.8
Platforms Platform Independent

Installation and Configuration

Pre-requisites

  1. Splunk Enterprise (6.5 or 6.6).
  2. Splunk Common Integration Model technology add-on 4.8 or above.
  3. Proofpoint Email Security App For Splunk 1.0.0 available on Splunkbase

  4. Proofpoint Email Security Add-On for Splunk 1.0.7 available on Splunkbase

Proofpoint Products (One or more)

  1. Proofpoint Enterprise Protection 8.0 and above
  2. Proofpoint On Demand 8.0 and above
  3. Target Attack Protection API access with API Service account and secret key

Product Configuration

  1. Hardware and Virtual Appliance deployments: Requires syslog configuration ( Logs and Reports > Log Settings)
  2. Proofpoint on Demand (PoD): Requires Remote Syslog Forwarding license. Please refer this document on how to configure remote syslog: https://proofpointcommunities.force.com/community/s/article/Remote-Syslog-Forwarding

Deployment

Single Server Deployment:

In a single server deployment, single instance of Splunk Enterprise functions as data collection node, indexer and search head. In such deployment, install the add-ons Proofpoint Email Security Add-On and Proofpoint TAP SIEM Modular Input. After that, install Proofpoint Email Security App For Splunk.

Distributed Deployment

In a distributed deployment, typically a combination of forwarders are deployed for data collection, separate indexer nodes for data injection and search heads for data visualization are deployed. We recommend installing our TA's on both Forwarder and Search heads and the App on the search head.

Component Heavy Forwarder Indexer Search head
Proofpoint Email Security Add-On for Splunk (TA) Install No (Note) Install
Proofpoint TAP SIEM Modular Input 1.0.1 available (TA) Install No (Note) Install
Proofpoint Email Security App For Splunk (App) No No Install

Note: When there is no forwarder, you will have to install TA on Indexer.

Splunk Configuration

Add UDP/TCP input to listen on the port for PPS logs and specify "pps_log" as sourcetype. You can do this from Splunk Admin Console.

  1. Go to "Settings" -> "Data Inputs"
  2. Click on "Add new" action for TCP or UDP input
  3. Enter port and click on "Next"
  4. In "Select sourcetype" search and select "pps_log" sourcetype if it already exists or create a new sourcetype as "pps_log" and Custom category. Click on "Review".
  5. Review config and submit to create a data source.
  6. Check data summary and sourcetypes tab to make sure the logs are being accepted for the pps_log sourcetype.

Proofpoint Email Protection Configuration

On the Proofpoint Email Protection admin console, enable syslog to forward to your Splunk instance

  1. Login to PPS as an admin user and navigate to “Logs and Reports > Log Settings”. Proofpoint on Demand customers please note that this feature requires a separate Remote Syslog license.
  2. Input syslog protocol, host and port numbers
  3. Enable Filter and Mail logs
  4. Click “Save Changes” 

Verification

PPS filter and mail logs are collected by the source type "pps_log" and are mapped to sourcetypes pps_filter_log and pps_mail_log. In the search box you can verify the logs by search for "sourcetype="pps_filter_log" and "sourcetype="pps_mail_log"

Release Notes

Version 1.0.8
Dec. 4, 2017

This add-on is designed to work with Proofpoint Email Security App for Splunk (TA).
* Update “Email” as category for pps_log and pps_mail_log sourcetype.
* Extracts host field in props.conf for pps_filter_log sourcetype.

Version 1.0.7
Sept. 25, 2017

Version 1.0.7

This add-on is designed to work with Proofpoint Email Security App for Splunk (TA).
* Can extract both filter and mail (mta) logs

Version 1.0.6
June 7, 2017

* Added field extractions for av, firewall, dkim, dmarc and spf
* Fixed regex for file_name field extraction to handle quoted value
* Changed regex for message_session_id field to extract from every line, if exists

Version 1.0.5
June 5, 2017

* Fixed regex for file_name field extraction to handle quoted value
* Changed regex for message_session_id field to extract from every line, if exists

Version 1.0.4
Jan. 30, 2017

Updated app icon to new logo.

Version 1.0.3
Jan. 30, 2017

* Updated app icon to new logo.
* Removed empty files under default directory.

Version 1.0.2
Jan. 10, 2017

Fix regular expression for recipient and src_user fields.

Version 1.0.1
Dec. 15, 2016

Version 1.0.1

* Added SHOULD_LINEMERGE=false property for source type pps_filter_log in default/props.conf.
* Added comment on a workaround of log data not being indexed issue for TRANSFORMS-set property in default/props.conf.

Version 1.0.0
March 3, 2016

Copyright (c) 2010-2016 by Proofpoint, Inc. All Rights Reserved.

Proofpoint, Proofpoint Protection Server and the Proofpoint logos are trademarks or registered trademarks of Proofpoint, Inc.

Proofpoint Protection Server - Technology Add-on for Splunk

Introduction

Customers interested in integrating Proofpoint Protection Server (PPS) logs with Splunk can utilize this custom-built add-on. This technology add-on focuses on normalizing the filter logs based on the Splunk Common Information Model (CIM) for email.

Splunk CIM Email Data Model

By normalizing filtering data produced by PPS to CIM-compliant Email data model, Splunk users can perform search, report or other operations they have built using the Email data model against PPS filtering data without further customizations, which eliminates the need to understand PPS filtering data format.

Pre-requisites

1. Splunk Enterprise (tested with version 6.3).
2. Splunk Common Integration Model technology add-on (refer below on how to install the CIM).
3. Pro

1,039
Installs
3,935
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.