mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-11 21:54:56 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
1.5 KiB
1.5 KiB
API Reference: Implementing Email Sandboxing with Proofpoint
Proofpoint TAP SIEM API
import requests
resp = requests.get(
"https://tap-api-v2.proofpoint.com/v2/siem/all",
auth=(principal, secret),
params={"sinceSeconds": 3600, "format": "json"})
data = resp.json()
# Keys: messagesDelivered, messagesBlocked, clicksPermitted, clicksBlocked
TAP API Endpoints
| Endpoint | Description |
|---|---|
/v2/siem/all |
All threat events |
/v2/siem/messages/blocked |
Blocked messages only |
/v2/siem/messages/delivered |
Delivered threats |
/v2/siem/clicks/blocked |
Blocked URL clicks |
/v2/siem/clicks/permitted |
Permitted URL clicks |
Threat Categories
| Category | Description | Severity |
|---|---|---|
| Malware | Malicious attachment | CRITICAL |
| Phish | Credential harvesting | HIGH |
| Impostor | BEC/spoofing | HIGH |
| Spam | Unsolicited | LOW |
URL Defense Configuration
{
"url_defense": {
"rewrite_all_urls": true,
"real_time_scanning": true,
"sandbox_detonation": true,
"click_time_protection": true
}
}
Splunk Integration
index=proofpoint sourcetype=tap:siem
| where classification="malicious"
| stats count by sender, threatType, subject
References
- Proofpoint TAP API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
- Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security-and-protection