Proofpoint PPS

Connect Qevlar to Proofpoint Protection Server (PPS) to investigate messages flagged at the email gateway, including quarantined emails with full header and attachment context. This page lists the permissions Qevlar requires and how to grant them.

Overview

Qevlar authenticates to Proofpoint PPS with a PPS account (username and password) sent as HTTP Basic authentication — no user sign-in per request. Access is governed by the account's role. The connector is read-only.

The API base is your PPS API endpoint.

Connection details

Enter these values when configuring the connector in Qevlar:

Required permissions

Use a PPS account assigned a role of type API with the pss and Quarantine managed modules selected. This grants the REST API read access to the quarantine and flagged message data (with header and attachment context) that Qevlar reads. No write permissions are required.

Setup

1. Create or choose an account. In the PPS console, use a dedicated account authorized to use the REST API.
2. Assign an API-type role. Ensure the account's role is type API with the pss and Quarantine managed modules selected, granting read access to quarantine and message data.
3. Confirm the API endpoint. Note the PPS API base URL for your deployment.
4. Configure the connector. In Qevlar, add the Proofpoint PPS connector and enter the connection details above.

Verify the connection

After saving, Qevlar runs a health check against the quarantine search endpoint. If it fails, check, in order:

1. The Base URL is correct and reachable from Qevlar.
2. The username and password are correct.
3. The account's role is type API with the pss and Quarantine managed modules selected.

API reference

Authentication: HTTP Basic with the account username and password.