--- title: "Proofpoint CASB collector" canonical: "https://docs.devo.com/space/latest/260833301/Proofpoint%20CASB%20collector" format: markdown --- > Macro (excerpt-include) > Macro (toc) ## Purpose An analyst wants to detect unauthorized sharing of sensitive information in cloud applications. Using the [Proofpoint CASB](https://www.proofpoint.com/us/products/cloud-security/cloud-app-security-broker) collector to send cloud application security events to Devo, the analyst will find when employees share restricted documents with external parties. As a result, the analyst will block external access to sensitive documents, preventing data exfiltratio ## Example tables | **Table** | **Description** | | --- | --- | | `casb.proofpoint.alert` | Security alerts from Proofpoint CASB | | `casb.proofpoint.event` | Cloud application security events | ## Flattening preprocessing | **Data Source** | **Collector Service** | **Flattening Details** | | --- | --- | --- | | Alerts | `alerts` | Alerts are flattened on the `related_events` field. Each resultant record includes all the fields of the parent object, the target child object, and fields identifying the index of the target child object. | | Events | `events` | Events are flattened on the `additionalProperties` field. Each resultant record includes all the fields of the parent object, the target child object, and fields identifying the index of the target child object. | ## Authorize it 1. **Install and configure Proofpoint CASB** in your cloud environment according to Proofpoint instructions. 2. Contact your Proofpoint customer representative to obtain your **API credentials**. 3. Request the following **credentials**: `api_key`, `cliend_id`, and `client_secret` ## Run it In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Proofpoint CASB** collector instance. Insert this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new). ``` "inputs": { "proofpoint_casb": { "id": "", "services": { "alerts": { "initial_start_time_in_utc": "" }, "credentials": { "client_id": "", "client_secret": "", "api_key": "" } } } } ``` ## Monitor it Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source using the query ``` from casb.proofpoint.alert where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id ``` Set the inactivity alert to keep track of the `collector_id`. ## Parameters ### Example ``` { "global_overrides": { "debug": false }, "inputs": { "proofpoint_casb": { "id": "", "credentials": { "client_id": "", "client_secret": "", "api_key": "" }, "commons": { "initial_start_time_in_utc": "" }, "services": { "alerts": { "initial_start_time_in_utc": "" } }, "events": { "initial_start_time_in_utc": "" } } } } ``` ### Details | **Parameter** | **Data Type** | **Necessity** | **Details** | | --- | --- | --- | --- | | `id` | `string` | `mandatory` | Five **unique** digits | | `api_key` | `string` | `mandatory` | The `api_key` obtained from Proofpoint for authentication. | | `client_id` | `string` | `mandatory` | The `client_id` obtained from Proofpoint for authentication. | | `client_secret ` | `string` | `mandatory` | The `client_secret` obtained from Proofpoint for authentication. | | `initial_start_time_in_utc` | `string` | `optional` | This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (one month back for example) before downloading new events.
Please note that setting the `initial_start_time_in_utc` for a particular service will override any `initial_start_time_in_utc` set in the commons level.
Format: `YYYY-mm-ddTHH:MM:SS.sssZ` | ## Troubleshooting This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors. Any persistent or internal issues, please contact [Devo Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | **ErrorType** | **Error Id** | **Error Message** | **Cause** | **Solution** | | --- | --- | --- | --- | --- | | `ProofpointCasbInitVariablesError` | 1 | `{error_message}` | There have been some kind of error while **reading** the user config file.
Read the error carefully and find the parameter that is causing the error. | Read the error and make the appropriate modifications in the user config file.
Some parameter could be missing, etc. | | `ProofpointCasbInitVariablesError` | 2 | `{error_message}` | There have been some kind of error while **validating** the user config file. Read the error carefully and find the parameter that is causing the error. | Read the error and make the appropriate modifications in the user config file.
The type of the parameter was not the expected one, etc. | | `ProofpointCasbInitVariablesError` | 3 | `{error_message}` | There have been some kind of error while initializing the client class used to communicate with the API. | This is an internal issue. | | `ProofpointCasbSetupError` | 101 | `Potential issue with authentication. Please check credentials and detailed error message: {error_message}` | The credentials used are not valid anymore. | Use some valid credentials. | | `ValueError` | - | `Retry-After header not found` | The `Retry-After` header is not included in the response. | This is an internal issue. | | `ValueError` | - | `Retry-After header value is None` | The `Retry-After` header is empty. | This is an internal issue. | | `TypeError` | - | `Invalid type {type}. Must be epoch seconds, epoch millis, str, datetime, or DateTime` | The type used for the date is not correct. | Use one of the formats specified in the error message. | ## API Endpoints | **Endpoint** | **Service** | **Table** | | --- | --- | --- | | `https://api-us1.protect.proofpoint.com/v1/alerts` | `alerts` | `casb.proofpoint.alert` | | `https://api-siem-us1.protect.proofpoint.com/v2/events` | `events` | `casb.proofpoint.event` | ## Devo collector features | **Feature** | **Details** | | --- | --- | | Allow parallel downloading (`multipod`) | `Allowed` | | Running environments | `Collector server` | | Populated Devo events | `Table` | | Flattening preprocessing | `Yes` | ## Release Notes - **v1.1.0 **(2024-05-13) - Upgraded Docker base image from 1.0.0 to 1.2.0 - Update DCSDK from 1.8.0 to 1.11.1: - Updated DCSDK from 1.8.0 to 1.11.1 Updated DevoSDK to v5.1.9 - Fixed some bug related to development on MacOS - Added an extra validation and fix when the DCSDK receives a wrong timestamp format - Added an optional config property for use the Syslog timestamp format in a strict way - Updated DevoSDK to v5.1.10 - Fix for SyslogSender related to UTF-8 - Enhace of troubleshooting. Trace Standardization, Some traces has been introduced. - Introduced a mechanism to detect "Out of Memory killer" situation - Updated DevoSDK to v5.1.9 - Fixed some bug related to development on MacOS - Added an extra validation and fix when the DCSDK receives a wrong timestamp format - Added an optional config property for use the Syslog timestamp format in a strict - Fixed the issue with 429 error because of number of request exceeded. - **Version 1.0.1 **(2023-06-15) - Update DCSDK from 1.5.0 to 1.8.0 - Updated limits: The requests limits have been updated with the values recommended by the API to avoid 429 errors. - **Version 1.0.0** (2022-11-29) - Initial release with support for alert and event collection from Proofpoint CASB API.