Proofpoint TAP — Integration Setup

Prerequisites

Proofpoint Targeted Attack Protection (TAP) subscription
Proofpoint Protection Server administrator access
CMDash Essentials tier or above

Step 1: Create a TAP SIEM API Service Principal

Log in to the Proofpoint TAP dashboard (https://threatinsight.proofpoint.com).
Go to Settings → Connected Applications.
Click Create new credential.
Name: CMDash Integration.
Type: SIEM API.
Permissions: Read on siem.
Copy the Service Principal and Secret — Proofpoint only shows the secret once.

Step 2: Connect in CMDash

Navigate to Integrations in your CMDash dashboard.
Find Proofpoint TAP and click Connect.
Enter:
- API Host (default https://tap-api-v2.proofpoint.com — leave unless you are on a regional cluster)
- Credentials — paste <principal>:<secret> in a single field. CMDash stores this encrypted.
Click Save & Test Connection.

What Syncs

Data Type	API	Sync Frequency
Delivered malicious messages (high-severity incidents)	`GET /siem/v1/messages/delivered?sinceSeconds=3600`	Every 30 minutes
Blocked malicious messages (reference data)	`GET /siem/v1/messages/blocked?sinceSeconds=3600`	Every 30 minutes

The TAP SIEM API only accepts sinceSeconds values up to 3600. CMDash walks back in 1-hour windows to cover up to the last 24 hours on each sync; longer back-windows are capped at 5000 records per bucket to bound runtime.

Severity Mapping

Messages in messagesDelivered → high (they bypassed MTA filtering)
Messages in messagesBlocked → medium, already marked resolved

Delivered messages are the ones your security team actually needs to act on — they show up on the CMDash Risks page, while blocked messages show up only in the Integration detail view as reference data.

Troubleshooting

HTTP 401 or 403: the credential was created with the wrong scope — must be SIEM API, not Forensics API. Regenerate.
HTTP 429: TAP SIEM API permits 1 request per second per principal. The adapter sleeps between sinceSeconds windows; if you still hit this, another integration may be using the same principal — create a dedicated one for CMDash.
Delivered count seems low: TAP only classifies messages as delivered after the delivery webhook fires, which can lag 5-15 minutes behind the actual delivery.