Current ThreatQ Version Filter
 

Proofpoint ET OSINT CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Proofpoint ET publishes IP Address and CIDR Block threat data in a text format. The Proofpoint ET OSINT feeds retrieve data using the following endpoints:

  • Proofpoint ET Block IP - https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
  • Proofpoint ET Compromised IPs - https://rules.emergingthreats.net/blockrules/compromised-ips.txt

The integration ingests indicators into the ThreatQ platform.  

Installation

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

  1. Navigate to your integrations management page in ThreatQ.
  2. Select the OSINT option from the Category dropdown (optional).

    If you are installing the integration for the first time, it will be located under the Disabled tab.

  3. Click on the integration entry to open its details page.
  4. Review any additional settings, make any changes if needed, and click on Save.
  5. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

Proofpoint ET Block IP

GET https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

Sample Response:

100.14.117.137
100.37.240.62
100.6.23.40
101.187.104.105
101.187.81.254
101.187.97.173
101.50.232.218
102.182.93.220
103.106.236.83
103.109.78.174
103.122.75.218
103.127.165.250
103.13.224.53
103.133.66.57

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Published Date Examples Notes
(first token) indicator.value IP Address or CIDR Block   100.14.117.137 If data contains "/" the indicator type will be CIDR Block, else "IP Address"'

Proofpoint ET Compromised IP

GET https://rules.emergingthreats.net/blockrules/compromised-ips.txt

Sample Response:

101.231.124.6
101.36.118.86
101.69.200.162
101.69.247.6
101.81.136.34
101.81.137.93
101.86.133.244
101.96.89.207
102.176.160.30
103.101.52.48
103.123.8.75

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path ThreatQ Entity ThreatQ Object Type or Attribute Key Published Date Examples Notes
0 (first token) indicator.value IP Address   101.231.124.6  

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Proofpoint ET Block IP

Metric Result
Run Time 3 mins
Indicators 2,300

Proofpoint ET Compromised IP

Metric Result
Run Time 2 mins
Indicators 1,000

Change Log

  • Version 1.0.0
    • Initial release

PDF Guides

Document ThreatQ Version
Proofpoint ET OSINT CDF Guide v1.0.0 4.3.0 or Greater