Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdeveloper-portal%2Finfrastructure-as-code%2Fterraform-provider%2Fintegrations%2Fproofpoint-collector.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdeveloper-portal%2Finfrastructure-as-code%2Fterraform-provider%2Fintegrations%2Fproofpoint-collector.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Proofpoint

## Overview[​](#overview "Direct link to Overview")

Coralogix integration for Proofpoint TAP SIEM logs.

For more information about this integration, [click here](https://coralogix.com/docs/docs/integrations/security/proofpoint/.md).

## How to use with Terraform[​](#how-to-use-with-terraform "Direct link to How to use with Terraform")

To deploy this integration using Terraform, you can use the [`coralogix_integration`](https://registry.terraform.io/providers/coralogix/coralogix/latest/docs/resources/integration) resource provided by the Coralogix Terraform provider. Below is an example configuration:

```
resource "coralogix_integration" "proofpoint-collector" {

  integration_key = "proofpoint-collector"

  version         = "0.1.0"



  parameters = {

    IntegrationName = "Proofpoint"

    ApplicationName = "<ApplicationName>"

    SubsystemName   = "Proofpoint"

    Principal       = "<Principal>"

    Secret          = "<Secret>"

    EventType       = ["All"]

    ThreatStatus    = ["Active", "Cleared", "FalsePositive"]

  }

}
```

Replace the placeholder values with your actual configuration parameters. Refer to the parameter table below for required fields and their descriptions.

## Revisions[​](#revisions "Direct link to Revisions")

0.1.0

### Initial release[​](#initial-release "Direct link to Initial release")

Proofpoint TAP SIEM API integration with multi-event-type selection.

| Name            | Type   | Required | Description                                                                                                                                                                                                                                                               |
| --------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| IntegrationName | String | Yes      | Name of the integration. Defaults to `Proofpoint`.                                                                                                                                                                                                                        |
| ApplicationName | String | Yes      | The application name that the integration will be used with.                                                                                                                                                                                                              |
| SubsystemName   | String | Yes      | The subsystem name that the integration will be used with. Defaults to `Proofpoint`.                                                                                                                                                                                      |
| Principal       | String | Yes      | Proofpoint TAP Service Principal (an identifier — not the secret).                                                                                                                                                                                                        |
| Secret          | String | Yes      | Proofpoint TAP Service Secret. Mint this in the Proofpoint Threat Insight Dashboard alongside the Service Principal.                                                                                                                                                      |
| EventType       | List   | Yes      | Which Proofpoint TAP events to ingest. Valid values: `All`, `Issues`, `MessagesDelivered`, `MessagesBlocked`, `ClicksPermitted`, `ClicksBlocked`. `All` cannot be combined with anything else; `Issues` cannot be combined with `MessagesDelivered` or `ClicksPermitted`. |
| ThreatStatus    | List   | Yes      | Which Proofpoint threat statuses to include in fetched events. Valid values: `Active`, `Cleared`, `FalsePositive`.                                                                                                                                                        |