Partnership Overview
Proofpoint Email Protection (formerly Proofpoint Protection Server, PPS) can forward its mail-flow and filter logs by syslog to your own SIEM. A Proofpoint event source on your NetWitness SIEM, RSA's former SIEM line, parses them, so email events sit alongside your other security data for reports and alerts.
Email events in your SIEM
Analysts see email gateway activity next to the rest of their security data, without checking a separate console.
Reports and alerts on email events
The Proofpoint event source parses the logs, so teams can run the SIEM’s reports and alerts on email without writing their own parser.
An export you control
Your administrator sets the log level, remote host, and protocol, and the logs go to your own SIEM.
EMAIL LOGS IN YOUR SIEM
An administrator turns on MTA Syslog and Filter Syslog in Proofpoint Email Protection and sets the log level, remote host, and protocol, so Email Protection forwards its mail-flow and filter logs to your SIEM, on-premises or on Proofpoint on Demand. A Proofpoint event source on the NetWitness SIEM parses the logs, so your team can run the SIEM's reports and alerts on email events.
Admin-Controlled Export
The administrator chooses the log level, the remote host, and UDP or TCP, and the logs go to your own SIEM.
Proofpoint Event Source
A Proofpoint parser on the NetWitness Log Decoders turns Email Protection mail-flow and filter logs into events the SIEM can use.
Reports and Alerts
Teams run the SIEM's reports and alerts on the parsed events, alongside their other sources, with no new console.
Request a Demo
Thank you!
A Proofpoint cybersecurity specialist will reach out to you shortly.
Recommended for You
An administrator enables MTA Syslog and Filter Syslog on Proofpoint Email Protection and sets the log level, remote host, and protocol. Email Protection forwards its mail-flow and filter logs to your NetWitness SIEM, where the Proofpoint event source parses them for reports and alerts. It covers mail-flow and filter logs, not Targeted Attack Protection (TAP) threat events.
RSA's SIEM line is now NetWitness, which announced its separation from RSA in 2023, so you may still see it listed as RSA NetWitness. The logs go to your own SIEM, not to RSA or NetWitness, and you configure the export yourself.
You need Proofpoint Email Protection (formerly PPS), on-premises or Proofpoint on Demand, with remote syslog enabled. Proofpoint on Demand customers need the remote syslog license. You also need a NetWitness SIEM with the Proofpoint event source installed. Confirm that it works with your PPS version before you begin.
