Integrating Proofpoint TAP into XSIAM

amcdonal363 — Thu, 05 Sep 2024 15:33:44 GMT

Hi,

I would like some guidance on which data source I should use when integrating Proofpoint TAP into XSIAM.

In the content pack "Proofpoint TAP" on the marketplace,

There is a data source named "Proofpoint TAP". This data source has the ability to fetch alerts, and it ingests into the "proofpoint_tap_v2_generic_alert_raw" data set. However it does not come with an associative data modeling rule. It does come with a correlation rule "Proofpoint TAP v2 Alerts (automatically generated)"

This method appears to have come from installing the Proofpoint TAP content pack on the marketplace

There is another data source named "Proofpoint Targeted Attack Protection" which can also fetch alerts, and it ingests into the "proofpoint_tap_raw" data set. It does come with a data modeling rule "[MODEL: dataset=proofpoint_tap_raw, content_id="ProofpointTAP"]" but it does not come with an associative correlation rule.

This method appears to be installed available by default XSIAM documentation

Both of these are stated to be supported by Palo Alto XSIAM. Why the difference here? Which one should be used? Should both be used, but in different ways? Why doesn't one come with a data modeling rule and why doesn't the other come with a basic correlation rule? Is the documentation out of date. Should the customer be redirected in the documentation to use the one in the "Proofpoint TAP" content pack?

topic Integrating Proofpoint TAP into XSIAM in Cortex XSIAM Discussions

Integrating Proofpoint TAP into XSIAM