---
title: "Proofpoint Isolation collector"
canonical: "https://docs.devo.com/space/latest/326729805/Proofpoint%20Isolation%20collector"
format: markdown
---
> Macro (excerpt-include)



> Macro (toc)

## Purpose

An analyst wants to detect malicious browsing attempts in corporate environments. Using the [Proofpoint Isolation](https://www.proofpoint.com/us/products/browser-isolation) collector to send browser and email isolation events to Devo, the analyst will find attempts to access malware-hosting websites. As a result, the analyst will block compromised user credentials, preventing attackers from accessing sensitive corporate resources.

## Example tables

| **Table** | **Description** |
| --- | --- |
| `tap.proofpoint.isolation.browser` | Browser isolation events |
| `tap.proofpoint.isolation.browser_and_email` | Combined browser and email isolation events |
| `tap.proofpoint.isolation.url` | URL isolation events |

## Authorize it

1. Install and configure** Proofpoint Isolation** in your environment according to Proofpoint instructions.
2. Contact your Proofpoint customer representative to obtain your **API credentials**.
3. Request an **API key** with read access to isolation reporting data.

## Run it

In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Proofpoint Isolation** collector instance.  Insert this parameters template, replacing the values enclosed in `< >`.  The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new).

```

  "inputs": {
    "proofpoint_isolation": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        ""browser_and_email_isolation": {
          "start_time_in_utc": "<START_TIME_IN_UTC_VALUE>",
          "request_period_in_seconds": 60
      },
      "credentials": {
        "api_key": "<API_KEY_VALUE>"
      }
    }
  }
}
```

## Monitor it

Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source  using the query

```
from tap.proofpoint.isolation.url 
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.

## Parameters

### Example

```
{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "proofpoint_isolation": {
      "id": "<short_unique_id>",
      "enabled": true,
      "credentials": {
        "api_key": "<api_key_value>"
      },
      "environment": "<environment_value>",
      "services": {
        "browser_and_email_isolation": {
          "start_time_in_utc": "<start_time_in_utc_value>",
          "request_period_in_seconds": 60
        },
        "url_isolation": {
          "start_time_in_utc": "<start_time_in_utc_value>",
          "request_period_in_seconds": 60
        }
      }
    }
  }
}
```

### Details

| **Parameter** | **Data type** | **Necessity** | **Details** |
| --- | --- | --- | --- |
| `id` | `string` | `mandatory` | Five **unique** digits |
| `api_key` | `string` | `mandatory` | The `api_key` obtained from Proofpoint for authentication. |
| `start_time_in_utc` | `string` | `optional` | This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (one month back for example) before downloading new events.<br>Please note that setting the `initial_start_time_in_utc` for a particular service will override any `initial_start_time_in_utc` set in the commons level.<br>Format: `YYYY-mm-ddTHH:MM:SS.sssZ` |
| `request_period_in_seconds` | `integer` | `optional` | By default, this service will run every `60` seconds. This parameter allows you to customize this behavior. |
| `obfuscation_data` | `array<object>` | `optional` | Each object represents the necessary configuration to obfuscate messages.<br>```
obfuscation_data:
  - name:
  - credentials
  - "*"
value: "**********"
``` |

## Troubleshooting

| **Error Type** | **Error Id** | **Error Message** | **Cause** | **Solution** |
| --- | --- | --- | --- | --- |
| ApiError | 403 | API Key XXXXXX is not valid. | Invalid API key | The key is not valid. Please create a new one through the Isolation system. |

## API Endpoints

| **Endpoint** | **Service** | **Table** |
| --- | --- | --- |
| `https://proofpointisolation.com/api/v2/reporting/usage-data/` | `browser_and_email_isolation` | `tap.proofpoint.isolation.browser_and_email` |
| `https://urlisolation.com/api/v2/reporting/usage-data/` | `url_isolation` | `tap.proofpoint.isolation.url_isolation` |

## Devo collector features

| **Feature** | **Details** |
| --- | --- |
| Allow parallel downloading (`multipod`) | `not allowed` |
| Running environments | `collector server` |
| Populated Devo events | `table` |
| Flattening preprocessing | `no` |
| Allowed source events obfuscation | `yes` |

## Release Notes

- **Version 1.1.1** (2023-09-26)
  - Fixed range values in user schemas for variable `override_query_window_offset_in_minutes`
- **Version 1.1.0** (2023-09-22)
  - Added window offset in minutes variable to ensure events are fully recorded in API before fetching, upgraded DCSDK to version 1.9.2, upgraded internal module dependencies
- **Version 1.0.0** (2023-05-30)
  - Initial release with Browser and Email Isolation service and URL Isolation service.