Changelog

Synapse-Proofpoint Changelog

Fixed the data migrations failing when a view is deleted while they run, or when a view’s write layer is read-only. Views with a read-only write layer are now skipped with a warning.
Fixed the proofpoint.privsep module allowing callers to change the authenticated request path by modifying modconf.
Fixed the minimum Optic version for the configuration workflow, which is now v2.135.0, since older Optic releases cannot start on Synapse v2.240.0 or later.

Added scraping of the Proofpoint campaign description for free-text indicators. Extracted nodes are linked to the ou:campaign node with refs light edges. MITRE ATT&CK forms are intentionally excluded to avoid false positives from overlap with Proofpoint actor and label names. Scraping is enabled by default and can be disabled with the --skip-scrape option on the proofpoint.tap.campaigns and proofpoint.tap.campaigns.get commands.

Fixed a bug where RFC 5322 display-name formatting (e.g. “Name <email@addr.com>”) addresses were not being properly handled for the inet:email:message nodes.

Migrated storage version tracking to use Storm package inits.
Migrated the detects edge to generated for the it:log:event and risk:alert nodes.
Migrated the detects edge to used for the ou:campaign nodes.

Added support for forensic types behavior, dns, file, and network for commands that fetch forensics information for campaigns and threats.
Added support for referencing inet:url nodes to the inet:email:message nodes for threats that were found in the message.
Added actor tags to the inet:url nodes for threats that were found in the message, including the identifiedAt timestamp.
Added new used edge for meta:rules nodes associated with ou:campaign nodes.

Fixed a bug where the tap.siem.messages.blocked command was not returning all forensics information for campaigns.
Fixed a bug where the --size argument of proofpoint.tap.campaigns would not respect a value of 1 correctly.
Fixed a bug where the proofpoint.tap.siem.messages.blocked command was not setting all headers for the inet:email:message nodes.

Added new proofpoint.tap.people.vap command to fetch VAP data from Proofpoint.
Added new proofpoint.tap.siem.messages.blocked command to fetch blocked messages from Proofpoint SIEM.
Added new --no-forensics option to the proofpoint.tap.campaigns.get and proofpoint.tap.threats.get commands to prevent fetching forensics information.

Updated the proofpoint.config.add and proofpoint.config.update commands to properly set and handle the principal and secret values instead of requiring a manually formatted Basic auth string.