Proofpoint API Client Library
First, install ppcli:
go get -u github.com/greenpau/go-proofpoint/cmd/ppcli
Next, set environment variables for Proofpoint API Service Principal:
export PROOFPOINT_SERVICE_PRINCIPAL=8c5e8866-0062-4059-b2be-92707e4374da export PROOFPOINT_PRINCIPAL_SECRET=f982025ecbaa8c42bec8b19c98c3ea7126241c130274cd06ac4f15cbd3ec5313737a425f
Alternatively, the settings could be passed in a configuration file. There are two options:
- The
ppcli.yamlshould be located in$HOME/.config/ppclior current directory - Pass the location via
-configflag
--- service_principal: 8c5e8866-0062-4059-b2be-92707e4374da principal_secret: f982025ecbaa8c42bec8b19c98c3ea7126241c130274cd06ac4f15cbd3ec5313737a425f
The following command fetches all events occured in the last 60 minutes from Proofpoint SIEM API:
ppcli -service-name siem -service-operation all -log-level debug