ProofpointPOD_maillog_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

Attribute Value
Custom Log V1 Yes 🔶 — uses type-suffixed column names
Ingestion API Supported ✓ Yes

Contents

Schema (31 columns)

Source: KQL validation test schema

Column Name Type
data_s string
event_type_s string
EventProduct string
EventVendor string
id_s string
metadata_origin_data_agent_s string
metadata_origin_data_cid_s string
pps_agent_s string
pps_cid_s string
sm_auth_s string
sm_class_s string
sm_ctladdr_s string
sm_daemon_s string
sm_delay_s string
sm_dsn_s string
sm_from_s string
sm_mailer_s string
sm_msgid_g string
sm_msgid_s string
sm_nrcpts_s string
sm_pri_s string
sm_proto_s string
sm_qid_s string
sm_relay_s string
sm_sizeBytes_s string
sm_stat_s string
sm_tls_verify_s string
sm_to_s string
sm_xdelay_s string
TimeGenerated datetime
ts_t datetime

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
[Deprecated] Proofpoint On Demand Email Security

Content Items Using This Table (23)

Analytic Rules (10)

In solution Proofpoint On demand(POD) Email Security:

Analytic Rule Selection Criteria
ProofpointPOD - Binary file in attachment
ProofpointPOD - Email sender IP in TI list
ProofpointPOD - Email sender in TI list
ProofpointPOD - High risk message not discarded
ProofpointPOD - Multiple archived attachments to the same recipient
ProofpointPOD - Multiple large emails to the same recipient
ProofpointPOD - Multiple protected emails to unknown recipient
ProofpointPOD - Possible data exfiltration to private email
ProofpointPOD - Suspicious attachment
ProofpointPOD - Weak ciphers

Hunting Queries (10)

In solution Proofpoint On demand(POD) Email Security:

Hunting Query Selection Criteria
ProofpointPOD - Emails with high score of 'adult' filter classifier value
ProofpointPOD - Emails with high score of 'malware' filter classifier value
ProofpointPOD - Emails with high score of 'phish' filter classifier value
ProofpointPOD - Emails with high score of 'spam' filter classifier value
ProofpointPOD - Emails with high score of 'suspect' filter classifier value
ProofpointPOD - Large size outbound emails
ProofpointPOD - Recipients with high number of discarded or rejected emails
ProofpointPOD - Recipients with large number of corrupted emails
ProofpointPOD - Senders with large number of corrupted messages
ProofpointPOD - Suspicious file types in attachments

Workbooks (3)

In solution Proofpoint On demand(POD) Email Security:

Workbook Selection Criteria
ProofpointPOD

GitHub Only:

Workbook Selection Criteria
ProofPointThreatDashboard
ProofpointPOD

Parsers Using This Table (1)

Other Parsers (1)

Parser Solution Selection Criteria
ProofpointPOD Proofpoint On demand(POD) Email Security

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index