How to I retrieve proofpoint data?

[danielbb]

Looking at Splunk base, and there are quite a lot of Proofpoint apps/TAs, which one should I install in order to connect to the Proofpoint endpoint and receive the data? 

[gcusello]

Hi @danielbb ,

there are many ProofPoint modules and many ways to take logs (syslogs, scripts, etc...)

see here to be guided: https://www.proofpoint.com/us/partners/splunk

Ciao.

Giuseppe

[danielbb]

Thank you @gcusello. Our Proofpoint account manager said the following - 

"There is an API but no mail flow API so Splunk wouldn't have anything on the Essentials side. Enterprise side - Remote Syslog gets them all sorts of mail flow details!
 Having said that, the only way to get an integration with Splunk would be to upgrade from Essentials to our Enterprise email."

Is there a way to get the Proofpoint data without an upgrade?

[PickleRick]

Proofpoint Essentials is - as far as I remember - a simplified Proofpoint on Demand service.

Proofpoint Enterprise can be deployed as either Proofpoint-managed Proofpoint on Demand service or an on-premise Proofpoint Protection Server installation.

As I understand, you're using Essentials so you're not interested in an on-premise installation. So your only way to get the detailed email flow info would be to upgrade to Enterprise and license the Remote Syslog Forwarding feature. Then you can set up your own TLS-secured "syslog" receiver and push the events from your PoD instance.

Essentials is a simplified service for small businesses and therefore doesn't have all the bells and whistles that "full" Enterprise setup has. But is way cheaper as I remember.

[danielbb]

Thank you Rick for the information!

[gcusello]

Hi @danielbb ,

I don't think it's possible with that ProofPoint, due to a problem at the source of it.
I have integrated many ProofPoints, but honestly I couldn't tell you what version or type of PP there was.

Ciao.

Giuseppe

[danielbb]

Thanks a lot!