Configure Proofpoint Essentials for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform sender email address-based response actions in your network using Proofpoint Essentials®.

Proofpoint Essentials supports these response actions:
  • Block/Unblock a sender

For more information, see Response action descriptions.

These resources are required:

  • An active Proofpoint Essentials account with Channel Admin or Organization Admin privileges.
  • At least one active domain must be configured in Proofpoint Essentials.
  • Contact your CST to validate the Active Response integration. Have an account or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create a Proofpoint Essentials integration user

  1. Sign in to the Proofpoint Essentials dashboard.
  2. Navigate to User Management > Users.
  3. From the top menu, select Add a User.
  4. In the Email Address field, enter the email address for the integration user.
  5. Set the Role to Organization Admin or Channel Admin, whichever role is available.
    Note: The Sender List APIs required for Active Response are accessible only to Organization Admin and Channel Admin roles.
  6. Leave Read-Only User unchecked.
  7. Click Save.
  8. From the top menu, select the Access Control tab, and then click Add Access Control.
  9. Enable only the Sender Lists permission, and disable all other permissions.
    Note: Only the Sender Lists permission is required for Active Response to function correctly.
  10. Save the Access Control configuration.
  11. Open the password setup email received by the integration user, and complete the password setup process.
  12. Copy the username and password, and then save them in a safe, encrypted location.

Identify the Proofpoint Essentials account information

  1. Sign in to the Proofpoint Essentials dashboard.
  2. Record the Base URL of your Proofpoint Essentials tenant from the browser address bar.
    Note: For example, if the URL in the browser is https://us2.proofpointessentials.com/i/2031014/dashboard, the Base URL is https://us2.proofpointessentials.com.
  3. Navigate to Account Management > Domains.
  4. Identify the Organization Domain to use for the integration.
  5. Copy the Base URL and Organization Domain, and then save them in a safe, encrypted location.

Provide Proofpoint Essentials Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Proofpoint Essentials.
  5. On the New Active Response Integration page, configure these settings:
  6. Click Save Integration.