Proofpoint TAP Integration with ADR

TABLE OF CONTENTS

• Overview
• Prerequisites
• Step 1: Generate Proofpoint TAP API Credentials
• Step 2: Configure in ADR
• Step 3: Validation
• Troubleshooting

Overview

This document provides the steps to integrate Proofpoint Targeted Attack Protection (TAP) with ADR/aiXDR, allowing ingestion of threat and message security data via API.

Prerequisites

• Administrative access to Proofpoint TAP Dashboard

• Valid Service Principal (Principal) and Secret credentials for API access

• Network access from ADR CCE to Proofpoint TAP API endpoint:
  https://tap-api.proofpoint.com/v2

• A valid CCE Host IP (or 127.0.0.1 for local setup)

Step 1: Generate Proofpoint TAP API Credentials

1. Log in to the Proofpoint TAP Dashboard as an Administrator.

2. Navigate to:
   Settings → Connected Applications (or API Access / Credential Management).

3. Click on Create New Credential or Generate Credentials.

4. Provide a name for the new credential set (e.g., ARIA Integration).

5. Click Generate to create API credentials.

6. The system will display two values:

   • Service Principal (Principal)

   • Secret

7. Copy and store both values securely, as the Secret will only be shown once.

Step 2: Configure in ADR

1. Login to the ADR UI with administrative credentials.

2. Navigate to:
   Administration → Device Management → Add Device

3. In the Add Device form, fill in as follows:

Example:

{}

4. Click Save to complete configuration.

Step 3: Validation

• Go to Device Management → confirm Proofpoint device status shows Active.

• Check Logs / Threat Data section to confirm ingestion of TAP alert data.

• Verify logs and indicators (malicious URLs, attachments, campaigns) under Device Type: proofpoint.

Troubleshooting