If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

The goal of this guide is to add a new SkyFormation for Proofpoint connector to your SkyFormation Platform.

Prerequisites

To add the Proofpoint connector to your SkyFormation app, you will need to have the following Proofpoint account's information at hand -

For the ATP - SIEM endpoint:

1. Service Principal
2. Service Principal Secret

For the PoD (Proofpoint on Demand) - LogAPI endpoints:

1. Cluster ID
2. Access Token

To get these parameters you need to go to the Settings page , Service Credentials -> Create new credentials.

Keep the 2 values generated for the next steps.

Steps

1. Logon to your SkyFormation Platform:

2. Navigate via left navigation panel to "Settings" section

3. Navigate via New Settings left navigation panel to "Accounts" section

4. Click the "Add Account" bottom

5. At the "SELECT SERVICE TO ADD" choose "Proofpoint". You will see the following screen:

6. Fill in the following information:

    - Account Name
        Give the Proofpoint account a meaningful name for you. 
        This will become your cloud app connector name displayed in the application and the 
        events sent to external systems as SIEM/Log management. This is a mandatory field.

      e.g. "Corporate Proofpoint"     

    - Description
      Add a text that describes the Proofpoint service account for you.

     This is an optional field.

   - Service Principal
      The service principal obtained in the prerequisite section

   - Secret
      The service principal secret obtained in the prerequisite section

For LogAPI endpoints

   - Cluster ID
      The cluster ID principal obtained in the prerequisite section

   - Access Token
      The access token obtained in the prerequisite section

At this point you can click on "TEST CONNECTION" to make sure the connection is setup successfully, or just click on "DONE".

Start the Proofpoint connector and make sure that the status becomes "OK" after a few seconds.

DONE!