topic Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk in Getting Data In

Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

SunilMaharishi — Wed, 03 Jan 2018 17:04:00 GMT

Hello Team ,

we have requirement to integrete the proofpoint threat response [ TRAP] appliance logs within splunk. i have checked and gone through documentation here and it seems we have options to integrate proofpoint email gateway and tap appliances but it seems there is no info i could find on how to integrate proofpoint Trap within spunk .

Kindly help to understand this , may be what i suspect is all logs we can capture using proofpoint email gateway itself and trap integration is not required or there is way to integrate the trap appliances logs , i dont have much idea how proofpoint exactly functions which is causing more confusion

Help is appreciated , currently we have proofpoint email gateway and TAP appliances and trap implemented in the organization and we are planning to integrate all 3 with splunk

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

eckolp2003 — Wed, 03 Jan 2018 18:24:14 GMT

There is not currently an integration with Splunk to send the TRAP logs into Splunk. We are working on adding this in a future release but do not have a firm timeline yet.

You are correct, only the email gateway and TAP have an integration with Splunk currently.

You can download the APP and related TA's here-

App:
https://splunkbase.splunk.com/app/3727/#/details

Gateway TA:
https://splunkbase.splunk.com/app/3080/

TAP TA:
https://splunkbase.splunk.com/app/3681/

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

SunilMaharishi — Wed, 03 Jan 2018 19:13:28 GMT

Thank you . So is integrating the gateway and tap solve the issue or trap does provide significant logs which aren't captured at email gateway end .

I mean email gateway also can send quarantine email and other logs . If you have any idea will be helpful

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

eckolp2003 — Wed, 03 Jan 2018 21:08:24 GMT

TRAP will have just logging of incidents which are basically pulled emails related to threats. This will still only be logged in the TRAP console but you can see the TAP related events in Splunk.

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

manderson7 — Wed, 20 Mar 2019 14:44:49 GMT

I know this is a very old thread, but I'm looking for a proofpoint TRAP add-on for Splunk. I see that the data can come in via syslog, but I'm concerned about field extractions. Is there one yet, or is there documentation for it yet?

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

skyelowryvancit — Thu, 31 Oct 2019 18:20:49 GMT

I am also looking for this, Any updates from Proofpoint on this one?

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

ylucena — Tue, 03 Dec 2019 16:38:35 GMT

Same here... Looking forward to integrate TRAP with splunk

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

riegelo — Wed, 15 Jul 2020 18:35:32 GMT

Just checking in to see if there has been any updates on proofpoint TRAP integration. I have been able to get the events into Splunk via syslog, but parsing is another matter. Unless I missed something I don't see any TA currently available in Splunkbase.

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

lpino — Wed, 19 Apr 2023 15:12:56 GMT

Hi there,

I know it passed quite a long time, but I am struggling to import TRAP logs into Splunk too.
Any news about this? Where did you set up syslog forwarding?

Thanks in advance

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

lpanella — Thu, 20 Apr 2023 12:50:02 GMT

Hello! Any news about TRAP the integration?

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

jbuckner85 — Fri, 08 Dec 2023 14:05:13 GMT

Hello, we have a requirement for this as well. Is there any update to this discussion? We have a need to integrate data sourced from ThreatResponse into our splunk solution.

Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk

rferg06 — Wed, 03 Jul 2024 19:27:04 GMT

Any chance that there will be a Splunk integration for TRAP?