Proofpoint Targeted Attack Protection
Configure the Proofpoint Targeted Attack Protection connector for Cortex XSIAM.
You can configure collecting Proofpoint Targeted Attack Protection (TAP) logs using a Standard Collector, content pack integration (onboarded prior to July 26, 2026), or connector (onboarded after July 26, 2026):
Standard Collector overview
Forward logs from Proofpoint Targeted Attack Protection to Cortex XSIAM using the Proofpoint Targeted Attack Protection data source.
Link to Standard Collector instructions
Link to content pack/integration details (onboarded prior to July 26, 2026)
The Proofpoint TAP content pack protects against phishing and malicious email attacks and provides enriched visibility and automated response capabilities for events detected by the Proofpoint Targeted Attack Protection service. It contains automations, classifiers, dashboards, issue fields, issue types, layouts, modeling rules, parsing rules, playbooks, and reports. It also includes the following integration:
Proofpoint TAP v2: Use this integration to protect against and provide additional visibility into phishing and other malicious email attacks. It includes commands that fetch events for clicks and messages related to known threats, return forensics evidence, fetch lists of campaign IDs, and fetch details for campaigns.
Link to connector (onboarded after July 26, 2026)
Last updated
Was this helpful?