Proofpoint Threat Response XSOAR integration Block URL, Block Domain, Block IP lists?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Proofpoint Threat Response XSOAR integration Block URL, Block Domain, Block IP lists?

L0 Member

Hello, we successfully have integrated Proofpoint Threat Response Logs into our XSOAR instance. One of the problems we noticed right away is that it seems like its only a one way API flow, as in we cannot send any commands from XSOAR back to Proofpoint Threat Response. For example, with the integration we created a layout with certain button scripts to block URL or block domain. When going to do so, the script asks for Blacklist Domain List ID, or Blacklist URL List ID? I have some visibility into our Proofpoint Admin console and I have no clue where these lists are being stored, or how to view them. Anyone else have Proofpoint TRAP integrated and able to successfully block IOC's and close TRAP incidents directly from XSOAR?


L4 Transporter

Hi @teegs7070, I think that is a limitation from ProofPoint's API. According to the documentation you need to get id's from the UI interface first. Below is an extract from the API documentation that was sent to our engineering team when the integration was created. I say this because, I was not able to find "List API" on the online documentation portal. It's either not available anymore or behind a customer portal.


List management API

One of the fundamental blocks of Threat Response is the concept of Lists. Lists are used to add hosts/hashes/urls to them and then block those atomic indicators on the enforcement devices. Threat Response exposes lists management functionality though the API. To perform actions on a list, you must first obtain the identification number (list-id) for that list in Threat Response. The steps below describe how to locate the ID:

1. Log in to Threat Response.

2. Navigate to the Lists page (and to the sub-tab for the list you are looking for).

3. Click on the desired list to display the list details.

4. Review the URL in your browser’s address bar; the ID will be at the end of the URL.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!