> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-proofpoint-targeted-attack-protection.md).

# Ingest Logs from Proofpoint Targeted Attack Protection

{% hint style="info" %}

### Notice

Ingestion of logs and data requires a Cortex XDR Pro per GB license.
{% endhint %}

{% hint style="info" %}

### Note

This data source is only available in your tenant if the tenant was activated before October 1, 2025 with an active Cortex XDR Pro per GB license.
{% endhint %}

To receive logs from Proofpoint Targeted Attack Protection (TAP), you must first configure TAP service credentials in the TAP dashboard, and then the Collection Integrations settings in Cortex XDR based on your Proofpoint TAP configuration. After you set up data collection, Cortex XDR begins receiving new logs and data from the source.

When Cortex XDR begins receiving logs, the app creates a new dataset (`proofpoint_tap_raw`) that you can use to initiate XQL Search queries. For example queries, refer to the in-app XQL Library.

Configure the Proofpoint TAP collection in Cortex XDR.

1. Generate TAP Service Credentials in Proofpoint TAP.

   TAP service credentials can be generated in the TAP Dashboard, where you will receive a Proofpoint Service Principal for authentication and Proofpoint API Secret for authentication. Record these credentials as you will need to provide them when configuring the **Proofpoint Targeted Attack Protection** data collector in Cortex XDR. For more information on generating TAP service credentials, see [Generate TAP Service Credentials](https://ptr-docs.proofpoint.com/ptr-guides/integrations-files/ptr-tap/).
2. Configure the Proofpoint TAP collection in Cortex XDR.
   1. Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**.
   2. In the **Proofpoint Targeted Attack Protection** configuration, click **Add Instance**.
   3. Set these parameters:
      * **Name**: Specify a descriptive name for your log collection configuration.
      * **Proofpoint Endpoint**: All Proofpoint endpoints are available on the `tap-api-v2.proofpoint.com` host. You can leave the default configuration or specify another host.
      * **Service Principal**: Specify the Proofpoint Service Principal for authentication. TAP service credentials can be generated in the TAP Dashboard.
      * **API Secret**: Specify the Proofpoint API Secret for authentication. TAP service credentials can be generated in the TAP Dashboard.
   4. Click **Test** to validate access, and then click **Enable**.

      Once events start to come in, a green check mark appears underneath the **Proofpoint Targeted Attack Protection** configuration with the amount of data received.
3. (Optional) Manage your **Proofpoint Targeted Attack Protection** data collector.

   After you enable the **Proofpoint Targeted Attack Protection** data collector, you can make additional changes as needed.

   You can perform any of the following:

   * **Edit** the **Proofpoint Targeted Attack Protection** data collector settings.
   * **Disable** the **Proofpoint Targeted Attack Protection** data collector.
   * **Delete** the **Proofpoint Targeted Attack Protection** data collector.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-proofpoint-targeted-attack-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.