Proofpoint Threat Response XSOAR integration Block URL, Block Domain, Block IP lists?

[teegs7070]

Hello, we successfully have integrated Proofpoint Threat Response Logs into our XSOAR instance. One of the problems we noticed right away is that it seems like its only a one way API flow, as in we cannot send any commands from XSOAR back to Proofpoint Threat Response. For example, with the integration we created a layout with certain button scripts to block URL or block domain. When going to do so, the script asks for Blacklist Domain List ID, or Blacklist URL List ID? I have some visibility into our Proofpoint Admin console and I have no clue where these lists are being stored, or how to view them. Anyone else have Proofpoint TRAP integrated and able to successfully block IOC's and close TRAP incidents directly from XSOAR?

[jfernandes1]

Hi @teegs7070, I think that is a limitation from ProofPoint's API. According to the documentation you need to get id's from the UI interface first. Below is an extract from the API documentation that was sent to our engineering team when the integration was created. I say this because, I was not able to find "List API" on the online documentation portal. It's either not available anymore or behind a customer portal.

List management API

One of the fundamental blocks of Threat Response is the concept of Lists. Lists are used to add hosts/hashes/urls to them and then block those atomic indicators on the enforcement devices. Threat Response exposes lists management functionality though the API. To perform actions on a list, you must first obtain the identification number (list-id) for that list in Threat Response. The steps below describe how to locate the ID:

1. Log in to Threat Response.

2. Navigate to the Lists page (and to the sub-tab for the list you are looking for).

3. Click on the desired list to display the list details.

4. Review the URL in your browser’s address bar; the ID will be at the end of the URL.