topic Re: How to I retrieve proofpoint data? in Getting Data In

How to I retrieve proofpoint data?

danielbb — Mon, 03 Feb 2025 16:30:56 GMT

Looking at Splunk base, and there are quite a lot of Proofpoint apps/TAs, which one should I install in order to connect to the Proofpoint endpoint and receive the data?

Re: How to I retrieve proofpoint data?

gcusello — Mon, 03 Feb 2025 16:35:30 GMT

Hi @danielbb ,

there are many ProofPoint modules and many ways to take logs (syslogs, scripts, etc...)

see here to be guided: https://www.proofpoint.com/us/partners/splunk

Ciao.

Giuseppe

Re: How to I retrieve proofpoint data?

danielbb — Mon, 10 Feb 2025 18:26:41 GMT

Thank you @gcusello. Our Proofpoint account manager said the following -

"There is an API but no mail flow API so Splunk wouldn't have anything on the Essentials side. Enterprise side - Remote Syslog gets them all sorts of mail flow details!
Having said that, the only way to get an integration with Splunk would be to upgrade from Essentials to our Enterprise email."

Is there a way to get the Proofpoint data without an upgrade?

Re: How to I retrieve proofpoint data?

gcusello — Tue, 11 Feb 2025 07:20:04 GMT

Hi @danielbb ,

I don't think it's possible with that ProofPoint, due to a problem at the source of it.
I have integrated many ProofPoints, but honestly I couldn't tell you what version or type of PP there was.

Ciao.

Giuseppe

Re: How to I retrieve proofpoint data?

PickleRick — Tue, 11 Feb 2025 09:24:55 GMT

Proofpoint Essentials is - as far as I remember - a simplified Proofpoint on Demand service.

Proofpoint Enterprise can be deployed as either Proofpoint-managed Proofpoint on Demand service or an on-premise Proofpoint Protection Server installation.

As I understand, you're using Essentials so you're not interested in an on-premise installation. So your only way to get the detailed email flow info would be to upgrade to Enterprise and license the Remote Syslog Forwarding feature. Then you can set up your own TLS-secured "syslog" receiver and push the events from your PoD instance.

Essentials is a simplified service for small businesses and therefore doesn't have all the bells and whistles that "full" Enterprise setup has. But is way cheaper as I remember.

Re: How to I retrieve proofpoint data?

danielbb — Tue, 11 Feb 2025 18:08:29 GMT

Thank you Rick for the information!

Re: How to I retrieve proofpoint data?

danielbb — Tue, 11 Feb 2025 18:08:54 GMT

Thanks a lot!