topic Re: Proofpoint TRAP Cloud -> Splunk in Getting Data In

Proofpoint TRAP Cloud -> Splunk

solg — Fri, 07 Feb 2025 12:06:24 GMT

TRAP Cloud has an API to export information, but there is no Add-On to integrate TRAP Cloud with Splunk

Has anyone made this integration succesfully?

Is there intention to implement a supported Add-On on Splunk to integrate TRAP Cloud?

Re: Proofpoint TRAP Cloud -> Splunk

kiran_panchavat — Fri, 07 Feb 2025 12:35:46 GMT

@solg It looks like there is nothing publicly available. We had to reach out to Proofpoint for the py script to get TRAP data in. It sounds like a question for ProofPoint.

You can download the APP and related TA's here:

App:
https://splunkbase.splunk.com/app/3727/#/details

Gateway TA:
https://splunkbase.splunk.com/app/3080/

TAP TA:
https://splunkbase.splunk.com/app/3681/

Re: Proofpoint TRAP Cloud -> Splunk

kiran_panchavat — Fri, 07 Feb 2025 12:49:14 GMT

@solg

As far as I know, you can send the TRAPS using HEC token or via Syslog. Kindly check the below add-on. This Add-on is intended to be installed on Splunk Search Heads or HF's and where Splunk HEC is configured for Proofpoint TRAP.

As of now, there is no official Splunk Add-On specifically designed for integrating Proofpoint Threat Response Auto-Pull (TRAP) Cloud with Splunk. However, the "CCX Extensions for Proofpoint Products" app on Splunkbase includes a component named proofpoint:trap:hec, which is intended for integrating Proofpoint TRAP with Splunk.

https://splunkbase.splunk.com/app/6339

Re: Proofpoint TRAP Cloud -> Splunk

solg — Tue, 11 Feb 2025 10:40:12 GMT

We investigated this add-on, but altough it mentions TRAP, there is no information provided to configure it.

TRAP Cloud integration method, as far as I know, is by API.

Re: Proofpoint TRAP Cloud -> Splunk

lexlexy — Wed, 12 Feb 2025 18:55:16 GMT

@kiran_panchavat we are facing similar issue, any chance you can share the py script you received from PP?