Proofpoint TAP

Connect Qevlar to Proofpoint Targeted Attack Protection (TAP) to investigate email threats using TAP verdicts, forensics, and threat intelligence. This page lists the credentials Qevlar requires and how to create them.

Overview

Qevlar authenticates to Proofpoint TAP with service credentials (a Service Principal and Secret) sent as HTTP Basic authentication — no user sign-in per request. The connector is read-only.

The API base is https://tap-api-v2.proofpoint.com/v2/.

Connection details

Enter these values when configuring the connector in Qevlar:

Required permissions

Create service credentials in the TAP dashboard. The resulting Service Principal grants access to the TAP threat APIs (SIEM events, forensics, and threat/campaign summaries). There are no granular scopes to configure, and no write access is involved.

Setup

1. Open Connected Applications. In the Proofpoint TAP dashboard, go to Settings → Connected Applications.
2. Create service credentials. Generate a new Service Principal and Secret.
3. Record the credentials. Copy the Service Principal and Secret — the secret is shown only once.
4. Configure the connector. In Qevlar, add the Proofpoint TAP connector and enter the connection details above.

Verify the connection

After saving, Qevlar runs a health check that reads recent SIEM events. If it fails, check, in order:

1. The Service Principal and Secret are correct and the secret has not been regenerated.
2. The service credentials are active in the TAP dashboard.

API reference

Authentication: HTTP Basic with the Service Principal as username and the Secret as password.