Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About eckolp2003
eckolp2003
Path Finder
Member since:
08-30-2016
06-05-2020
Community Statistics
| Posts | 28 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 5 |
| Member Since | 08-30-2016 |
Activity Feed
- Karma (Beta) Proofpoint Email Security App for Splunk content returns no results for mdsnmss. 06-05-2020 12:49 AM
- Karma Re: (Beta) Proofpoint Email Security App for Splunk content returns no results for mdsnmss. 06-05-2020 12:49 AM
- Karma Re: Why is there an event delay in Proofpoint TAP Modular Input? for marycordova. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the proofpoint dashboard display "waiting for data"?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is there an event delay in Proofpoint TAP Modular Input?. 06-05-2020 12:49 AM
- Karma Re: I have mapped data in my app to the relevant CIM data model, but why do I get no search results in Splunk Enterprise Security? for smoir_splunk. 06-05-2020 12:48 AM
- Got Karma for Re: Proofpoint Protection Server TA for Splunk: How do I get this field extracted from my sample event?. 06-05-2020 12:48 AM
- Got Karma for Re: Proofpoint Protection Server TA for Splunk: How do I get this field extracted from my sample event?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pull logs into Splunk from Proofpoint via APIs or any other methods from a Proofpoint Cloud instance?. 06-05-2020 12:48 AM
- Posted Re: Has anyone scrubbed proofpoint's TAP sourcetype for alerting? on Splunk Enterprise Security. 10-30-2018 12:44 PM
- Posted Re: How do I get Proofpoint Targeted Attack Protection logs ingested into Splunk? on Getting Data In. 10-30-2018 12:43 PM
- Posted Re: How to pull logs into Splunk from Proofpoint via APIs or any other methods from a Proofpoint Cloud instance? on Getting Data In. 08-29-2018 10:08 AM
- Posted Re: How to pull logs into Splunk from Proofpoint via APIs or any other methods from a Proofpoint Cloud instance? on Getting Data In. 08-29-2018 10:08 AM
- Posted Re: How to pull logs into Splunk from Proofpoint via APIs or any other methods from a Proofpoint Cloud instance? on Getting Data In. 08-29-2018 10:06 AM
- Posted Re: Proofpoint TAP modular input in the distributed environment. on Getting Data In. 08-29-2018 10:03 AM
- Posted Re: AntiSpam update report on All Apps and Add-ons. 06-28-2018 10:15 AM
- Posted Re: Proofpoint in the distributed environment on Deployment Architecture. 06-25-2018 11:45 AM
- Posted Re: Proofpoint in the distributed environment on Deployment Architecture. 06-19-2018 09:20 AM
- Posted Re: Why is the proofpoint dashboard display "waiting for data"? on Dashboards & Visualizations. 03-13-2018 01:13 PM
- Posted Re: (Beta) Proofpoint Email Security App for Splunk content returns no results on All Apps and Add-ons. 02-01-2018 01:41 PM
Topics I've Started
No posts to display.
10-30-2018
12:44 PM
You would want to base then on eventType
The two I would alert on are: clicksPermitted or messagesDelivered
... View more
10-30-2018
12:43 PM
If you want the filter and MTA logs from your Protection server you will also want to add your Splunk server to the remote log server settings located in: Logs and Reports > Log Settings in Protection.
... View more
08-29-2018
10:08 AM
Please follow this guide:
https://splunkbase.splunk.com/app/3727/#/details
... View more
08-29-2018
10:08 AM
If you ingest the filter logs from your Protection server with remote syslog, you can see every action taken on all messages.
You are correct that the TAP data is a more limited set and includes 4 eventTypes: messagesBlocked messagesDelivered clicksPermitted clicksBlocked
Thanks
... View more
08-29-2018
10:06 AM
Point taken. We are moving to an API driven TA and app for our next release. Look for the beta to come our around .Conf18
... View more
08-29-2018
10:03 AM
Please follow this guide:
https://splunkbase.splunk.com/app/3727/#/details
You should be installing this both on the search head and a heavy forwarder. You do not need to edit the conf file if you do this.
... View more
06-28-2018
10:15 AM
The next version of the app will correct some of the broken reports. For now, you are welcome to edit the search query as needed.
... View more
06-25-2018
11:45 AM
For deployment help, please refer to this page:
https://splunkbase.splunk.com/app/3727/#/details
... View more
06-19-2018
09:20 AM
If you want to have pre-built reports and dashboards, you want to install the app. The TAP TA just pulls in TAP data and parses it. So, no it is not required but it makes the data more useful.
... View more
03-13-2018
01:13 PM
1 Karma
Hello,
This is likely due to your data not going to the correct index. Could you follow these steps below to see if it corrects your problem?
Changing the Index
By default this app uses the "main" index to look for Proofpoint logs. To change this to an index that the Proofpoint Email Security Add-On uses, you need to edit the get_pps_index macro. Here are the steps:
Navigate to Settings->Advanced Search and select "Search macros"
Change the app context to "Proofpoint Email Security App for Splunk"
Select the macro named "get_pps_index"
Change index=main to the correct index. Please make sure this index matches the one used the Proofpoint Email Security Add-On for Splunk.
Save the configuration.
... View more
02-01-2018
01:41 PM
Ok, that explains why. The TA's should normally go on a heavy forwarder and if you are not using one, they would have to go on your indexer.
... View more
02-01-2018
01:29 PM
1 Karma
Thanks Mary. This code change should occur in a future version release to permanently correct this issue but your method is a valid work around for now.
... View more
02-01-2018
01:02 PM
Could you tell me more about your deployment? Most deployments should not need this installed on an indexer.
... View more
02-01-2018
12:49 PM
Have you been able to verify you have data coming in? Can you confirm all the steps you have done so far?
The app setup is fairly well documented here:
https://splunkbase.splunk.com/app/3080/#/details
We need to determine if this is a sourcetype issue or some other problem.
... View more
01-03-2018
01:08 PM
TRAP will have just logging of incidents which are basically pulled emails related to threats. This will still only be logged in the TRAP console but you can see the TAP related events in Splunk.
... View more
01-03-2018
10:24 AM
There is not currently an integration with Splunk to send the TRAP logs into Splunk. We are working on adding this in a future release but do not have a firm timeline yet.
You are correct, only the email gateway and TAP have an integration with Splunk currently.
You can download the APP and related TA's here-
App:
https://splunkbase.splunk.com/app/3727/#/details
Gateway TA:
https://splunkbase.splunk.com/app/3080/
TAP TA:
https://splunkbase.splunk.com/app/3681/
... View more
10-16-2017
09:47 AM
Thanks for documenting this for others!
... View more
10-11-2017
07:34 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
There are pre-built dashboards to aid in searching for message events.
... View more
10-11-2017
07:34 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
There are pre-built dashboards to aid in searching for message events.
... View more
10-09-2017
02:41 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
10-09-2017
02:40 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
10-09-2017
02:39 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
10-09-2017
02:38 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
10-09-2017
02:37 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
10-09-2017
02:35 PM
Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:
https://splunkbase.splunk.com/app/3727/#/details
Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
