« Proofpoint TAP Pulse Connect Secure Integration »
Elastic Docs ›Elastic integrations

Proofpoint On Demand

edit

Proofpoint On Demand

edit

Version

1.3.0 (View all)

Compatible Kibana version(s)

8.16.0 or higher

Supported Serverless project types
What’s this?

Security
Observability

Subscription level
What’s this?

Basic

Level of support
What’s this?

Elastic

Proofpoint on Demand is a cloud-based cybersecurity platform that offers a wide range of services to protect businesses against cyber threats. This includes email security, threat intelligence, information protection, and compliance solutions. The Proofpoint on Demand integration for Elastic provides insight into the functioning and effectiveness of your email security policies, allowing you to make informed decisions to improve security posture.

The Proofpoint On Demand integration collects data for Audit, Mail, and Message logs utilizing the Secure WebSocket (WSS) protocol for log streaming.

Data streams

edit

The Proofpoint On Demand integration collects data for the following three events:

  • Audit
  • Mail
  • Message

Requirements

edit

Elastic Agent must be installed. For more details and installation instructions, please refer to the Elastic Agent Installation Guide.

Installing and managing an Elastic Agent:

edit

There are several options for installing and managing Elastic Agent:

Install a Fleet-managed Elastic Agent (recommended):

edit

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

Install Elastic Agent in standalone mode (advanced users):

edit

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

Install Elastic Agent in a containerized environment:

edit

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.

Please note, there are minimum requirements for running Elastic Agent. For more information, refer to the Elastic Agent Minimum Requirements.

Setup

edit

To collect data from the Proofpoint On Demand Log Service:

edit

The Cluster ID is displayed in the upper-right corner of the management interface, next to the release number. Proofpoint will provide the token for each cluster.

Proofpoint On Demand Log service requires a Remote Syslog Forwarding license. Please refer the documentation on how to enable it.

Enabling the integration in Elastic:

edit
  1. In Kibana navigate to Management > Integrations.
  2. In "Search for integrations" top bar, search for Proofpoint On Demand.
  3. Select the "Proofpoint On Demand" integration from the search results.
  4. Select "Add Proofpoint On Demand" to add the integration.
  5. Add all the required integration configuration parameters, including Cluster ID and Access Token, to enable data collection.
  6. Click on "Save and continue" to save the integration.

Logs Reference

edit

Audit

edit

This is the Audit dataset.

Example

An example event for audit looks as following:

{
    "@timestamp": "2023-10-30T06:13:37.162Z",
    "agent": {
        "ephemeral_id": "47390a83-5b53-47d7-8583-4e2075c0c3a7",
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "proofpoint_on_demand.audit",
        "namespace": "14398",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "login",
        "agent_id_status": "verified",
        "category": [
            "authentication"
        ],
        "dataset": "proofpoint_on_demand.audit",
        "id": "792f514f-15cb-480d-825e-e3565d32f928",
        "ingested": "2024-07-25T09:11:29Z",
        "kind": "event",
        "original": "{\"audit\":{\"action\":\"login\",\"level\":\"INFO\",\"resourceType\":\"authorization\",\"tags\":[{\"name\":\"eventSubCategory\",\"value\":\"authorization\"},{\"name\":\"eventDetails\",\"value\":\"\"},{\"name\":\"login.authorization\",\"value\":\"true\"}],\"user\":{\"email\":\"bob@example.org\",\"id\":\"a7e6abcd-1234-7901-1234-abcdefc31236\",\"ipAddress\":\"1.128.0.0\"}},\"guid\":\"792f514f-15cb-480d-825e-e3565d32f928\",\"metadata\":{\"customerId\":\"c8215678-6e78-42dd-a327-abcde13f9cff\",\"origin\":{\"data\":{\"agent\":\"89.160.20.128\",\"cid\":\"pphosted_prodmgt_hosted\",\"version\":\"1.0\"},\"schemaVersion\":\"1.0\",\"type\":\"cadmin-api-gateway\"}},\"ts\":\"2023-10-30T06:13:37.162521+0000\"}",
        "type": [
            "start"
        ]
    },
    "input": {
        "type": "websocket"
    },
    "labels": {
        "eventSubCategory": "authorization",
        "login.authorization": "true"
    },
    "log": {
        "level": "INFO"
    },
    "observer": {
        "ip": [
            "89.160.20.128"
        ],
        "name": "pphosted_prodmgt_hosted",
        "product": "Proofpoint On Demand",
        "vendor": "Proofpoint",
        "version": "1.0"
    },
    "proofpoint_on_demand": {
        "audit": {
            "action": "login",
            "guid": "792f514f-15cb-480d-825e-e3565d32f928",
            "level": "INFO",
            "metadata": {
                "customer_id": "c8215678-6e78-42dd-a327-abcde13f9cff",
                "origin": {
                    "data": {
                        "agent_ip": "89.160.20.128",
                        "cid": "pphosted_prodmgt_hosted",
                        "version": "1.0"
                    },
                    "schema_version": "1.0",
                    "type": "cadmin-api-gateway"
                }
            },
            "resource_type": "authorization",
            "tags": [
                {
                    "name": "eventSubCategory",
                    "value": "authorization"
                },
                {
                    "name": "eventDetails"
                },
                {
                    "name": "login.authorization",
                    "value": "true"
                }
            ],
            "ts": "2023-10-30T06:13:37.162Z",
            "user": {
                "email": "bob@example.org",
                "id": "a7e6abcd-1234-7901-1234-abcdefc31236",
                "ip_address": "1.128.0.0"
            }
        }
    },
    "related": {
        "ip": [
            "89.160.20.128",
            "1.128.0.0"
        ],
        "user": [
            "bob@example.org",
            "a7e6abcd-1234-7901-1234-abcdefc31236"
        ]
    },
    "source": {
        "ip": "1.128.0.0",
        "user": {
            "email": "bob@example.org",
            "id": "a7e6abcd-1234-7901-1234-abcdefc31236"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "proofpoint_on_demand-audit"
    ]
}
Exported fields
Field Description Type

@timestamp

Event timestamp.

date

data_stream.dataset

Data stream dataset.

constant_keyword

data_stream.namespace

Data stream namespace.

constant_keyword

data_stream.type

Data stream type.

constant_keyword

event.dataset

Event dataset.

constant_keyword

event.module

Event module.

constant_keyword

input.type

Type of filebeat input.

keyword

labels.create.policyRoutes

keyword

labels.create.threatProtectionApiKeys

keyword

labels.delete.policyRoutes

keyword

labels.delete.threatProtectionApiKeys

keyword

labels.edit.spamDetection.policies

keyword

labels.eventDetails

keyword

labels.eventSubCategory

keyword

labels.execute.search

keyword

labels.login.authorization

keyword

labels.logout.authorization

keyword

labels.read.sendMailSearch

keyword

log.offset

Log offset.

long

proofpoint_on_demand.audit.action

Resource action.

keyword

proofpoint_on_demand.audit.guid

Globally unique identifier for this message object.

keyword

proofpoint_on_demand.audit.level

Event log level.

keyword

proofpoint_on_demand.audit.metadata.customer_id

The customer ID.

keyword

proofpoint_on_demand.audit.metadata.origin.data.agent

The source host the audit event occurred.

keyword

proofpoint_on_demand.audit.metadata.origin.data.agent_ip

ip

proofpoint_on_demand.audit.metadata.origin.data.cid

The cluster ID license for the PPS deployment.

keyword

proofpoint_on_demand.audit.metadata.origin.data.version

The release PPS version.

keyword

proofpoint_on_demand.audit.metadata.origin.schema_version

Schema version of this message payload.

keyword

proofpoint_on_demand.audit.metadata.origin.type

The type of origin, i.e. PPS, Cloudmark, etc.

keyword

proofpoint_on_demand.audit.metadata.trace.id

Trace ID information for trafficstats needs.

keyword

proofpoint_on_demand.audit.metadata.trace.ts

Trace timestamp information for trafficstats needs.

date

proofpoint_on_demand.audit.resource_name

Resource name.

keyword

proofpoint_on_demand.audit.resource_type

Resource type.

keyword

proofpoint_on_demand.audit.service.cid

The cluster id from the IDM service token.

keyword

proofpoint_on_demand.audit.service.customer_id

The customer id of the service.

keyword

proofpoint_on_demand.audit.service.id

The IDM service id.

keyword

proofpoint_on_demand.audit.service.ip_address

The IP address of the service.

ip

proofpoint_on_demand.audit.tags

nested

proofpoint_on_demand.audit.tags.name

Tag name for the particular instance of event.

keyword

proofpoint_on_demand.audit.tags.value

The value associated with the tag name.

keyword

proofpoint_on_demand.audit.ts

Timestamp of when the event to be audited occurred.

date

proofpoint_on_demand.audit.user.email

User email address.

keyword

proofpoint_on_demand.audit.user.id

User ID.

keyword

proofpoint_on_demand.audit.user.ip_address

IP Address from where the user logged in.

ip

proofpoint_on_demand.audit.user.roles_assigned

User Authorization information.

keyword

Mail

edit

This is the Mail dataset.

Example

An example event for mail looks as following:

{
    "@timestamp": "2024-06-19T12:28:32.533Z",
    "agent": {
        "ephemeral_id": "0cda9434-4fc8-4bab-ad7b-70616889e081",
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "proofpoint_on_demand.mail",
        "namespace": "41202",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "snapshot": false,
        "version": "8.13.0"
    },
    "email": {
        "to": {
            "address": [
                "mailive@example.com"
            ]
        }
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "email"
        ],
        "dataset": "proofpoint_on_demand.mail",
        "id": "NABCDefGH0/I1234slqccQ",
        "ingested": "2024-07-25T09:12:42Z",
        "kind": "event",
        "original": "{\"data\":\"2024-06-19T05:28:32.533564-07:00 m0000123 sendmail[17416]: 45ABSW12341234: to=\\u003cmailive@example.com\\u003e, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, tls_verify=OK, tls_version=TLSv1.2, cipher=ECDHE-RSA-AES256-GCM, pri=121557, relay=test4.example.net. [216.160.83.56], dsn=2.0.0, stat=Sent (Ok: queued)\",\"id\":\"NABCDefGH0/I1234slqccQ\",\"metadata\":{\"customerId\":\"c82abcde-5678-42dd-1234-1234563f9cff\",\"origin\":{\"data\":{\"agent\":\"m0000123.ppops.net\",\"cid\":\"pphosted_prodmgt_hosted\"},\"schemaVersion\":\"20200420\"}},\"pps\":{\"agent\":\"m0000123.ppops.net\",\"cid\":\"pphosted_prodmgt_hosted\"},\"sm\":{\"delay\":\"00:00:00\",\"dsn\":\"2.0.0\",\"mailer\":\"esmtp\",\"pri\":\"121557\",\"qid\":\"45ABSW12341234\",\"relay\":\"test4.example.net. [216.160.83.56]\",\"stat\":\"Sent (Ok: queued)\",\"to\":[\"\\u003cmailive@example.com\\u003e\"],\"xdelay\":\"00:00:00\"},\"tls\":{\"cipher\":\"ECDHE-RSA-AES256-GCM\",\"verify\":\"OK\",\"version\":\"TLSv1.2\"},\"ts\":\"2024-06-19T05:28:32.533564-0700\"}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "websocket"
    },
    "message": "2024-06-19T05:28:32.533564-07:00 m0000123 sendmail[17416]: 45ABSW12341234: to=<mailive@example.com>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, tls_verify=OK, tls_version=TLSv1.2, cipher=ECDHE-RSA-AES256-GCM, pri=121557, relay=test4.example.net. [216.160.83.56], dsn=2.0.0, stat=Sent (Ok: queued)",
    "observer": {
        "hostname": "m0000123.ppops.net",
        "name": "pphosted_prodmgt_hosted",
        "product": "Proofpoint On Demand",
        "type": "mail-gateway",
        "vendor": "Proofpoint"
    },
    "proofpoint_on_demand": {
        "mail": {
            "data": "2024-06-19T05:28:32.533564-07:00 m0000123 sendmail[17416]: 45ABSW12341234: to=<mailive@example.com>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, tls_verify=OK, tls_version=TLSv1.2, cipher=ECDHE-RSA-AES256-GCM, pri=121557, relay=test4.example.net. [216.160.83.56], dsn=2.0.0, stat=Sent (Ok: queued)",
            "id": "NABCDefGH0/I1234slqccQ",
            "metadata": {
                "origin": {
                    "data": {
                        "agent": "m0000123.ppops.net",
                        "cid": "pphosted_prodmgt_hosted"
                    }
                }
            },
            "pps": {
                "agent": "m0000123.ppops.net",
                "cid": "pphosted_prodmgt_hosted"
            },
            "sm": {
                "delay": "00:00:00",
                "dsn": "2.0.0",
                "mailer": "esmtp",
                "priority": 121557,
                "qid": "45ABSW12341234",
                "relay": "test4.example.net. [216.160.83.56]",
                "status": "Sent (Ok: queued)",
                "to": [
                    "mailive@example.com"
                ],
                "xdelay": "00:00:00"
            },
            "tls": {
                "cipher": "ECDHE-RSA-AES256-GCM",
                "verify": "OK",
                "version": "TLSv1.2"
            },
            "ts": "2024-06-19T12:28:32.533Z"
        }
    },
    "related": {
        "hosts": [
            "m0000123.ppops.net"
        ],
        "user": [
            "mailive@example.com"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "proofpoint_on_demand-mail"
    ],
    "tls": {
        "cipher": "ECDHE-RSA-AES256-GCM",
        "version": "1.2",
        "version_protocol": "tls"
    }
}
Exported fields
Field Description Type

@timestamp

Event timestamp.

date

data_stream.dataset

Data stream dataset.

constant_keyword

data_stream.namespace

Data stream namespace.

constant_keyword

data_stream.type

Data stream type.

constant_keyword

event.dataset

Event dataset.

constant_keyword

event.module

Event module.

constant_keyword

input.type

Type of filebeat input.

keyword

log.offset

Log offset.

long

proofpoint_on_demand.mail.data

The raw data that corresponds to one log line from maillog.

keyword

proofpoint_on_demand.mail.id

A unique ID for the object.

keyword

proofpoint_on_demand.mail.metadata.origin.data.agent

keyword

proofpoint_on_demand.mail.metadata.origin.data.cid

keyword

proofpoint_on_demand.mail.metadata.origin.data.version

keyword

proofpoint_on_demand.mail.pps.agent

The FQDN of the source agent on which the mail log line is produced.

keyword

proofpoint_on_demand.mail.pps.cid

The cluster ID from which the data log line originated.

keyword

proofpoint_on_demand.mail.pps.version

keyword

proofpoint_on_demand.mail.sm.auth

keyword

proofpoint_on_demand.mail.sm.class

The class (i.e., numeric precedence) of the message.

long

proofpoint_on_demand.mail.sm.ctladdr

The "controlling user", that is, the name of the user whose credentials are used for delivery.

keyword

proofpoint_on_demand.mail.sm.daemon

The daemon name from the DaemonPortOptions setting.

keyword

proofpoint_on_demand.mail.sm.delay

The total message delay: (the time difference between reception and final delivery or bounce). Format is delay=HH:MM::SS for a delay of less than one day and delay=days+HH:MM::SS otherwise.

keyword

proofpoint_on_demand.mail.sm.dsn

The enhanced error code (RFC2034) if available.

keyword

proofpoint_on_demand.mail.sm.from

The envelope sender address.

keyword

proofpoint_on_demand.mail.sm.mailer

The name of the mailer used to deliver to this recipient.

keyword

proofpoint_on_demand.mail.sm.msgid

The message id of the message (from the header).

keyword

proofpoint_on_demand.mail.sm.nrcpts

The number of envelope recipients for this message (after aliasing and forwarding).

long

proofpoint_on_demand.mail.sm.priority

The initial message priority (used for queue sorting).

long

proofpoint_on_demand.mail.sm.protocol

The protocol used to receive this message (e.g., ESMTP or UUCP).

keyword

proofpoint_on_demand.mail.sm.qid

The corresponding sendmail queue ID for the log line.

keyword

proofpoint_on_demand.mail.sm.relay

Shows which user or system sent / received the message; the format is one of relay=user(a)domain [IP], relay=user(a)localhost, or relay=fqdn host.

keyword

proofpoint_on_demand.mail.sm.size_bytes

The size of the incoming message in bytes during the DATA phase, including end-of-line characters.

long

proofpoint_on_demand.mail.sm.status

The delivery status of the message.

keyword

proofpoint_on_demand.mail.sm.tls.verify

The tls_verify data is included in two log lines. When the data appears in the from= log line, it describes TLS results when the message was received by the Proofpoint Protection Server. When the data appears in the to= log line, it describes TLS results when the message was sent from the Proofpoint Protection Server.

keyword

proofpoint_on_demand.mail.sm.to

Recipients to this mailer.

keyword

proofpoint_on_demand.mail.sm.xdelay

The total time the message took to be transmitted during final delivery. This differs from the delay= equate, in that the xdelay= equate only counts the time in the actual final delivery.

keyword

proofpoint_on_demand.mail.tls.cipher

keyword

proofpoint_on_demand.mail.tls.verify

keyword

proofpoint_on_demand.mail.tls.version

keyword

proofpoint_on_demand.mail.ts

Timestamp of logging time in ISO8601 format.

date

Message

edit

This is the Message dataset.

Example

An example event for message looks as following:

{
    "@timestamp": "2024-05-22T19:10:03.058Z",
    "agent": {
        "ephemeral_id": "6d737326-c5db-4dc6-8693-e42b208cd0fb",
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "proofpoint_on_demand.message",
        "namespace": "92037",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "8561ea27-9bb2-4207-aed6-dba9ce3b1a40",
        "snapshot": false,
        "version": "8.13.0"
    },
    "email": {
        "from": {
            "address": [
                "\"(Cron Daemon)\" <pps@m0000123.ppops.net>"
            ]
        },
        "message_id": [
            "<212345678910.44ABCDE1231370@m0000123.ppops.net>"
        ],
        "sender": {
            "address": "pps@m0000123.ppops.net"
        },
        "subject": [
            "Cron <pps@m0000123> /opt/proofpoint/resttimer.pl"
        ],
        "to": {
            "address": [
                "pps@m0000123.ppops.net"
            ]
        }
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "email"
        ],
        "dataset": "proofpoint_on_demand.message",
        "duration": 118720000,
        "id": "vRq4ZIFWHXbuABCDEFghij0U4VvIc71x",
        "ingested": "2024-07-25T09:13:55Z",
        "kind": "event",
        "original": "{\"connection\":{\"country\":\"**\",\"helo\":\"m0000123.ppops.net\",\"host\":\"localhost\",\"ip\":\"127.0.0.1\",\"protocol\":\"smtp:smtp\",\"resolveStatus\":\"ok\",\"sid\":\"3y8abcd123\",\"tls\":{\"inbound\":{\"cipher\":\"ECDHE-RSA-AES256-GCM-SHA384\",\"cipherBits\":256,\"version\":\"TLSv1.2\"}}},\"envelope\":{\"from\":\"pps@m0000123.ppops.net\",\"rcpts\":[\"pps@m0000123.ppops.net\"]},\"filter\":{\"actions\":[{\"action\":\"accept\",\"isFinal\":true,\"module\":\"access\",\"rule\":\"system\"}],\"delivered\":{\"rcpts\":[\"pps@m0000123.ppops.net\"]},\"disposition\":\"accept\",\"durationSecs\":0.11872,\"msgSizeBytes\":1127,\"qid\":\"44ABCDm0000123\",\"routeDirection\":\"outbound\",\"routes\":[\"allow_relay\",\"firewallsafe\"],\"suborgs\":{\"rcpts\":[\"0\"],\"sender\":\"0\"},\"verified\":{\"rcpts\":[\"pps@m0000123.ppops.net\"]}},\"guid\":\"vRq4ZIFWHXbuABCDEFghij0U4VvIc71x\",\"metadata\":{\"origin\":{\"data\":{\"agent\":\"m0000123.ppops.net\",\"cid\":\"pphosted_prodmgt_hosted\",\"version\":\"8.21.0.1358\"}}},\"msg\":{\"header\":{\"from\":[\"\\\"(Cron Daemon)\\\" \\u003cpps@m0000123.ppops.net\\u003e\"],\"message-id\":[\"\\u003c212345678910.44ABCDE1231370@m0000123.ppops.net\\u003e\"],\"subject\":[\"Cron \\u003cpps@m0000123\\u003e /opt/proofpoint/resttimer.pl\"],\"to\":[\"pps@m0000123.ppops.net\"]},\"lang\":\"\",\"normalizedHeader\":{\"from\":[\"\\\"(Cron Daemon)\\\" \\u003cpps@m0000123.ppops.net\\u003e\"],\"message-id\":[\"212345678910.44ABCDE1231370@m0000123.ppops.net\"],\"subject\":[\"Cron \\u003cpps@m0000123\\u003e /opt/proofpoint/resttimer.pl\"],\"to\":[\"pps@m0000123.ppops.net\"]},\"parsedAddresses\":{},\"sizeBytes\":1151},\"msgParts\":[],\"ts\":\"2024-05-22T12:10:03.058340-0700\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "websocket"
    },
    "network": {
        "direction": "outbound",
        "protocol": "smtp"
    },
    "observer": {
        "hostname": "m0000123.ppops.net",
        "name": "pphosted_prodmgt_hosted",
        "product": "Proofpoint On Demand",
        "type": "mail-gateway",
        "vendor": "Proofpoint",
        "version": "8.21.0.1358"
    },
    "proofpoint_on_demand": {
        "message": {
            "connection": {
                "helo": "m0000123.ppops.net",
                "host": "localhost",
                "ip": "127.0.0.1",
                "protocol": "smtp:smtp",
                "resolve_status": "ok",
                "sid": "3y8abcd123",
                "tls": {
                    "inbound": {
                        "cipher": "ECDHE-RSA-AES256-GCM-SHA384",
                        "cipher_bits": 256,
                        "version": "TLSv1.2"
                    }
                }
            },
            "envelope": {
                "from": "pps@m0000123.ppops.net",
                "rcpts": [
                    "pps@m0000123.ppops.net"
                ]
            },
            "filter": {
                "actions": [
                    {
                        "action": "accept",
                        "is_final": true,
                        "module": "access",
                        "rule": "system"
                    }
                ],
                "disposition": "accept",
                "duration_secs": 0.11872,
                "msg_size_bytes": 1127,
                "qid": "44ABCDm0000123",
                "route_direction": "outbound",
                "routes": [
                    "allow_relay",
                    "firewallsafe"
                ],
                "verified": {
                    "rcpts": [
                        "pps@m0000123.ppops.net"
                    ]
                }
            },
            "guid": "vRq4ZIFWHXbuABCDEFghij0U4VvIc71x",
            "metadata": {
                "origin": {
                    "data": {
                        "agent": "m0000123.ppops.net",
                        "cid": "pphosted_prodmgt_hosted",
                        "version": "8.21.0.1358"
                    }
                }
            },
            "msg": {
                "header": {
                    "from": [
                        "\"(Cron Daemon)\" <pps@m0000123.ppops.net>"
                    ],
                    "message_id": [
                        "<212345678910.44ABCDE1231370@m0000123.ppops.net>"
                    ],
                    "subject": [
                        "Cron <pps@m0000123> /opt/proofpoint/resttimer.pl"
                    ],
                    "to": [
                        "pps@m0000123.ppops.net"
                    ]
                },
                "normalized_header": {
                    "from": [
                        "\"(Cron Daemon)\" <pps@m0000123.ppops.net>"
                    ],
                    "message_id": [
                        "212345678910.44ABCDE1231370@m0000123.ppops.net"
                    ],
                    "subject": [
                        "Cron <pps@m0000123> /opt/proofpoint/resttimer.pl"
                    ],
                    "to": [
                        "pps@m0000123.ppops.net"
                    ]
                },
                "size_bytes": 1151
            },
            "ts": "2024-05-22T19:10:03.058Z"
        }
    },
    "related": {
        "hosts": [
            "m0000123.ppops.net",
            "localhost"
        ],
        "ip": [
            "127.0.0.1"
        ],
        "user": [
            "pps@m0000123.ppops.net",
            "\"(Cron Daemon)\" <pps@m0000123.ppops.net>"
        ]
    },
    "source": {
        "address": "m0000123.ppops.net",
        "domain": "localhost",
        "ip": "127.0.0.1"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "proofpoint_on_demand-message"
    ],
    "tls": {
        "cipher": "ECDHE-RSA-AES256-GCM-SHA384",
        "version": "1.2",
        "version_protocol": "tls"
    }
}
Exported fields
Field Description Type

@timestamp

Event timestamp.

date

data_stream.dataset

Data stream dataset.

constant_keyword

data_stream.namespace

Data stream namespace.

constant_keyword

data_stream.type

Data stream type.

constant_keyword

event.dataset

Event dataset.

constant_keyword

event.module

Event module.

constant_keyword

input.type

Type of filebeat input.

keyword

log.offset

Log offset.

long

proofpoint_on_demand.message.action_dkimv.action

keyword

proofpoint_on_demand.message.action_dkimv.module

keyword

proofpoint_on_demand.message.action_dkimv.rule

keyword

proofpoint_on_demand.message.action_dmarc.action

keyword

proofpoint_on_demand.message.action_dmarc.module

keyword

proofpoint_on_demand.message.action_dmarc.rule

keyword

proofpoint_on_demand.message.action_spf.action

keyword

proofpoint_on_demand.message.action_spf.module

keyword

proofpoint_on_demand.message.action_spf.rule

keyword

proofpoint_on_demand.message.connection.country

The country code of the sender IP.

keyword

proofpoint_on_demand.message.connection.helo

The FQDN or IP reported via the HELO or EHLO command.

keyword

proofpoint_on_demand.message.connection.host

The host name of the reverse lookup of the sender IP.

keyword

proofpoint_on_demand.message.connection.ip

The sender IP in IPv4 or IPv6 format.

ip

proofpoint_on_demand.message.connection.protocol

The connection protocol info.

keyword

proofpoint_on_demand.message.connection.resolve_status

Can the sender IP be resolved with a reverse lookup.

keyword

proofpoint_on_demand.message.connection.sid

The ID of the connection/session object; this is otherwise known as the "sid" in filter.log.

keyword

proofpoint_on_demand.message.connection.tls.inbound.cipher

Inbound TLS cipher algorithm detected.

keyword

proofpoint_on_demand.message.connection.tls.inbound.cipher_bits

Inbound TLS cipher algorithm strength (in #bits).

long

proofpoint_on_demand.message.connection.tls.inbound.policy

Inbound TLS policy.

keyword

proofpoint_on_demand.message.connection.tls.inbound.version

Inbound TLS protocol version.

keyword

proofpoint_on_demand.message.envelope.from

The envelope sender.

keyword

proofpoint_on_demand.message.envelope.from_hashed

keyword

proofpoint_on_demand.message.envelope.rcpts

The envelope recipients.

keyword

proofpoint_on_demand.message.envelope.rcpts_hashed

keyword

proofpoint_on_demand.message.filter.actions.action

keyword

proofpoint_on_demand.message.filter.actions.is_final

boolean

proofpoint_on_demand.message.filter.actions.module

keyword

proofpoint_on_demand.message.filter.actions.rule

keyword

proofpoint_on_demand.message.filter.current_folder

The folder to which the message is currently assigned.

keyword

proofpoint_on_demand.message.filter.disposition

The message disposition string as determined by filterd (the filtering engine daemon).

keyword

proofpoint_on_demand.message.filter.duration_secs

Time spent processing the message.

double

proofpoint_on_demand.message.filter.is_msg_encrypted

Is the message encrypted.

boolean

proofpoint_on_demand.message.filter.is_msg_reinjected

Was the message reinjected.

boolean

proofpoint_on_demand.message.filter.mid

The message id.

keyword

proofpoint_on_demand.message.filter.modules.av.virus_names

The virus names reported by the AV module.

keyword

proofpoint_on_demand.message.filter.modules.dkimv.domain

The DKIM d= value in the signature line.

keyword

proofpoint_on_demand.message.filter.modules.dkimv.result

The DKIM result.

keyword

proofpoint_on_demand.message.filter.modules.dkimv.selector

The DKIM s= value in the signature line.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.alignment.from_domain

The DMARC TLD from the MAIL FROM data.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.alignment.results.identity

The DMARC domain identity as reported in the signature.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.alignment.results.identity_org

The DMARC identifying organization as a Top Level Domain.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.alignment.results.method

The DMARC method involved for an alignment result object.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.alignment.results.result

The DMARC result involved for the alignment result object.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.email_identities.header.from

The header.from email identity for a DMARC authorization result object.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.email_identities.smtp.helo

The smtp.helo email identity for a DMARC authorization result object.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.email_identities.smtp.mailfrom

The smtp.mailfrom email identity for a DMARC authorization result object.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.email_identities.smtp.mailfrom_hashed

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.method

The authorization result method.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.propspec.header.d

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.propspec.header.s

The header.s value for the property specification for the authorization result per DMARC spec.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.reason

The reason string for the authorization result.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.auth_results.result

The result value for the authorization result.

keyword

proofpoint_on_demand.message.filter.modules.dmarc.filterd_result

The rollup DMARC result (generated by filterd for the rules, i.e. $dmarcresult).

keyword

proofpoint_on_demand.message.filter.modules.dmarc.records

The actual raw DMARC TXT record.

nested

proofpoint_on_demand.message.filter.modules.dmarc.srvid

DMARC Auth Service ID as defined in filter.cfg.

keyword

proofpoint_on_demand.message.filter.modules.pdr.v1.rscore

The PDR (Proofpoint Dynamic Reputation) v1 rscore value.

long

proofpoint_on_demand.message.filter.modules.pdr.v1.spamscore

The PDR v1 spamscore value.

long

proofpoint_on_demand.message.filter.modules.pdr.v1.virusscore

The PDR v1 virusscore value.

long

proofpoint_on_demand.message.filter.modules.pdr.v2.response

The PDR v2 response status.

keyword

proofpoint_on_demand.message.filter.modules.pdr.v2.rscore

The PDR v2 rscore value.

long

proofpoint_on_demand.message.filter.modules.sandbox.error_status

The Attachment Defense error status string.

keyword

proofpoint_on_demand.message.filter.modules.spam.triggered_classifier

The one spam classifier as defined by policy rules that determined the spam disposition.

keyword

proofpoint_on_demand.message.filter.modules.spf.domain

keyword

proofpoint_on_demand.message.filter.modules.spf.result

The SPF (Sender Policy Framework) result.

keyword

proofpoint_on_demand.message.filter.modules.urldefense.counts.max_limit

The configured defined maximum number of unique URLs the URL Defense Module can process.

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_content_type_text

The total number of URLs that the URL Defense did not rewrite due to "is content type text".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_email

The total number of URLs the URL Defense Module did not rewrite due to "is email".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_excluded_domain

The total number of URLs the URL Defense Module did not rewrite due to "is excluded domain".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_large_msgpart_size

The total number of URLs the URL Defense Module did not rewrite due to "is large message part size".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_maxlength_exceeded

The total number of URLs the URL Defense Module did not rewrite due to "is max length exceeded".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_schemeless

The total number of URLs the URL Defense Module did not rewrite due to "is schemeless".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.no_rewrite.is_unsupported_scheme

The total number of URLs the URL Defense Module did not rewrite due to "is unsupported scheme".

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.rewritten

The total number of URLs the URL Defense Module rewrote.

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.total

The total number of URLs the URL Defense processed.

long

proofpoint_on_demand.message.filter.modules.urldefense.counts.unique

The total unique number of URLs the URL Defense Module processed.

long

proofpoint_on_demand.message.filter.modules.urldefense.rewritten_urls

The URLs rewritten by URL Defense.

keyword

proofpoint_on_demand.message.filter.modules.urldefense.version.engine

Engine version for the URL Defense Module.

keyword

proofpoint_on_demand.message.filter.modules.zerohour.score

The ZeroHour threat score.

keyword

proofpoint_on_demand.message.filter.msg_size_bytes

The size of the email in bytes.

long

proofpoint_on_demand.message.filter.orig_guid

The parent GUID for the message from which the current message was split.

keyword

proofpoint_on_demand.message.filter.pe.rcpts

Recipients encrypted via Proofpoint Encryption.

keyword

proofpoint_on_demand.message.filter.pe.rcpts_object

Recipients encrypted via Proofpoint Encryption.

nested

proofpoint_on_demand.message.filter.qid

The sendmail queue ID.

keyword

proofpoint_on_demand.message.filter.quarantine.folder

Quarantine folder containing a copy of the message.

keyword

proofpoint_on_demand.message.filter.quarantine.rule

Rule that causes the message to be quarantined.

keyword

proofpoint_on_demand.message.filter.route_direction

keyword

proofpoint_on_demand.message.filter.routes

The policy routes triggered by the message.

keyword

proofpoint_on_demand.message.filter.smime.rcpts

Recipients encrypted via S/MIME.

keyword

proofpoint_on_demand.message.filter.smime.signed_rcpts

Recipients signed and encrypted via S/MIME.

keyword

proofpoint_on_demand.message.filter.start_time

Timestamp for when message processing begins.

date

proofpoint_on_demand.message.filter.suborgs.rcpts

keyword

proofpoint_on_demand.message.filter.suborgs.sender

keyword

proofpoint_on_demand.message.filter.throttle_ip

The IP address being rate-controlled.

ip

proofpoint_on_demand.message.filter.verified.rcpts

Verified recipients.

keyword

proofpoint_on_demand.message.filter.verified.rcpts_hashed

keyword

proofpoint_on_demand.message.final_action

keyword

proofpoint_on_demand.message.final_module

keyword

proofpoint_on_demand.message.final_rule

keyword

proofpoint_on_demand.message.guid

Globally unique identifier for the message object.

keyword

proofpoint_on_demand.message.metadata.origin.data.agent

keyword

proofpoint_on_demand.message.metadata.origin.data.cid

keyword

proofpoint_on_demand.message.metadata.origin.data.version

keyword

proofpoint_on_demand.message.msg.header.cc

Carbon copy of email addresses.

keyword

proofpoint_on_demand.message.msg.header.from

The header sender.

keyword

proofpoint_on_demand.message.msg.header.from_hashed

keyword

proofpoint_on_demand.message.msg.header.message_id

The header message-id.

keyword

proofpoint_on_demand.message.msg.header.reply_to

The header Reply to address.

keyword

proofpoint_on_demand.message.msg.header.return_path

The header return path address.

keyword

proofpoint_on_demand.message.msg.header.subject

The header subject.

keyword

proofpoint_on_demand.message.msg.header.to

The header recipients.

keyword

proofpoint_on_demand.message.msg.header.to_hashed

keyword

proofpoint_on_demand.message.msg.lang

The detected language of the message.

keyword

proofpoint_on_demand.message.msg.normalized_header.cc

keyword

proofpoint_on_demand.message.msg.normalized_header.from

keyword

proofpoint_on_demand.message.msg.normalized_header.from_hashed

keyword

proofpoint_on_demand.message.msg.normalized_header.message_id

keyword

proofpoint_on_demand.message.msg.normalized_header.reply_to

keyword

proofpoint_on_demand.message.msg.normalized_header.return_path

keyword

proofpoint_on_demand.message.msg.normalized_header.subject

keyword

proofpoint_on_demand.message.msg.normalized_header.to

keyword

proofpoint_on_demand.message.msg.normalized_header.to_hashed

keyword

proofpoint_on_demand.message.msg.parsed_addresses.cc

keyword

proofpoint_on_demand.message.msg.parsed_addresses.from

keyword

proofpoint_on_demand.message.msg.parsed_addresses.from_hashed

keyword

proofpoint_on_demand.message.msg.parsed_addresses.to

keyword

proofpoint_on_demand.message.msg.parsed_addresses.to_hashed

keyword

proofpoint_on_demand.message.msg.size_bytes

The original, raw message size in bytes.

long

proofpoint_on_demand.message.msg_parts.database64

keyword

proofpoint_on_demand.message.msg_parts.detected_charset

The detected charset of the message part.

keyword

proofpoint_on_demand.message.msg_parts.detected_ext

The detected extension of the message part.

keyword

proofpoint_on_demand.message.msg_parts.detected_mime

The detected MIME type of the message part.

keyword

proofpoint_on_demand.message.msg_parts.detected_name

The detected file name of the message part.

keyword

proofpoint_on_demand.message.msg_parts.detected_size_bytes

The detected file size of the message part in bytes.

long

proofpoint_on_demand.message.msg_parts.disposition

The content disposition value.

keyword

proofpoint_on_demand.message.msg_parts.is_archive

Is the message part an archive type.

boolean

proofpoint_on_demand.message.msg_parts.is_corrupted

Is the message part corrupted.

boolean

proofpoint_on_demand.message.msg_parts.is_deleted

Is the message part deleted.

boolean

proofpoint_on_demand.message.msg_parts.is_protected

Is the message part password protected.

boolean

proofpoint_on_demand.message.msg_parts.is_timed_out

Did the message part analysis or text extraction time out.

boolean

proofpoint_on_demand.message.msg_parts.is_virtual

Is the message part virtual (a file member in an archive type of attachment).

boolean

proofpoint_on_demand.message.msg_parts.labeled_charset

The charset of the message part as given.

keyword

proofpoint_on_demand.message.msg_parts.labeled_ext

The extension of the attachment as given.

keyword

proofpoint_on_demand.message.msg_parts.labeled_mime

The detected MIME type of the message part as given.

keyword

proofpoint_on_demand.message.msg_parts.labeled_name

The name of the message part as given.

keyword

proofpoint_on_demand.message.msg_parts.md5

The ID of the message part in MD5.

keyword

proofpoint_on_demand.message.msg_parts.metadata

The metadata of the message part as reported by cvtd (interface to the document extraction engine).

object

proofpoint_on_demand.message.msg_parts.sandbox_status

The sandbox module status for the message part.

keyword

proofpoint_on_demand.message.msg_parts.sha256

The ID of the message part in SHA256.

keyword

proofpoint_on_demand.message.msg_parts.size_decoded_bytes

The size of the decoded message part in bytes.

long

proofpoint_on_demand.message.msg_parts.structure_id

The Structural ID of the message part with respect to container type attachments.

keyword

proofpoint_on_demand.message.msg_parts.text_extracted

keyword

proofpoint_on_demand.message.msg_parts.urls.is_rewritten

Whether the URL was rewritten by URL Defense.

boolean

proofpoint_on_demand.message.msg_parts.urls.not_rewritten_reason

The reason why the corresponding URL was not rewritten by URL Defense. The value is an empty string if it was rewritten.

keyword

proofpoint_on_demand.message.msg_parts.urls.src

The PPS sources that detected the URL.

keyword

proofpoint_on_demand.message.msg_parts.urls.url

The URL found in the corresponding message part.

keyword

proofpoint_on_demand.message.pps.agent

The source/MFA host from which the email was received.

keyword

proofpoint_on_demand.message.pps.cid

The cluster ID license for the PPS deployment.

keyword

proofpoint_on_demand.message.pps.version

The release PPS version.

keyword

proofpoint_on_demand.message.ts

date

Changelog

edit
Changelog
Version Details Kibana version(s)

1.3.0

Enhancement (View pull request)
Add "preserve_original_event" tag to documents with event.kind manually set to "pipeline_error".

8.16.0 or higher

1.2.0

Enhancement (View pull request)
Added support for configurable retry options which was introduced in 8.16.

8.16.0 or higher

1.1.0

Enhancement (View pull request)
Add "preserve_original_event" tag to documents with event.kind set to "pipeline_error".

8.13.0 or higher

1.0.2

Bug fix (View pull request)
Fix script processor in mail data-stream.

8.13.0 or higher

1.0.1

Bug fix (View pull request)
Fix handling of malformed input.

Bug fix (View pull request)
Fix type checking for mapping filter.pe.rcpt to ECS.

8.13.0 or higher

1.0.0

Enhancement (View pull request)
Release package as GA.

8.13.0 or higher

0.1.1

Bug fix (View pull request)
Fix definition of subfields of nested objects

—

0.1.0

Enhancement (View pull request)
Initial release.

—
« Proofpoint TAP Pulse Connect Secure Integration »