topic Re: Proofpoint TAP Integration - XQL Query Help in Cortex XDR Discussions

Proofpoint TAP Integration - XQL Query Help

Marc_Denman — Fri, 17 May 2024 00:57:32 GMT

Has anyone worked with PP TAP integration and creating any useful XQL queries to help identify potential malicious mail that a user interacts with? As example:
Email was not determined "bad" initially but after some sandbox from PP, it is later classified as "bad" and is blocked. Before that scenario took place, there is potential for one or more users who clicked on the "bad link" from the email. Is there any way to surface that via XQL query since we're ingesting those logs from PP?

Re: Proofpoint TAP Integration - XQL Query Help

david2658 — Mon, 20 May 2024 05:07:15 GMT

Hello,

While I don't have specific experience with PP TAP integration and XQL queries, it's theoretically possible to identify potential malicious emails that users interacted with by analyzing the logs from PP TAP. One approach could involve creating XQL queries to search for patterns or indicators of malicious activity, such as URLs or domains associated with known threats. You could also look for anomalies in email behavior, such as a mass general patient portal sudden increase in email clicks or interactions with suspicious content. Additionally, leveraging PP TAP's sandboxing data to correlate email interactions with later determinations of maliciousness could help identify potentially compromised emails. However, implementing such queries would depend on the specific logging capabilities and data schema provided by PP TAP, as well as your organization's policies and requirements for detecting and mitigating email threats. Consulting with security experts or leveraging community resources for XQL query examples related to email security may also be beneficial in this context.

Re: Proofpoint TAP Integration - XQL Query Help

Marc_Denman — Mon, 20 May 2024 14:16:37 GMT

Thanks for the response. All makes sense. I guess I was hoping I might find some example XQL queries that others have used with the Proofpoint TAP log integration to get me started in the proper direction. Perhaps I will just dig more and have to experiment with those logs to see what may (may not) be useful in surfacing evidence in the example scenario in original post.

Thanks!