Install and configure the Proofpoint integration for Data Loss Prevention

Install and configure the  Proofpoint DLP integration from the  ServiceNow® Store on your  ServiceNow AI Platform instance. Start investigating DLP incidents using the  Proofpoint DLP incident data.

Before you begin

Role required: sn_dlir.admin

Procedure

1. Download the  Proofpoint DLP integration from the  ServiceNow® Store and install it.
2. Navigate to Security Operations > Integrations  > Integration Configurations.
3. Search for the  DLP Incident Response Integration with Proofpoint tile, and click  Configure.

   

4. On the form, fill in the fields.

   Table 1. Proofpoint DLP Integration Configuration form

   Field	Description
   Name	Name of the Proofpoint DLP integration configuration.
   Base URL	URL for the Proofpoint that serves as the REST endpoint.
   Client ID	The ID of Proofpoint client to be used.
   Client Secret	The secret configured for your user account on Proofpoint.

   

   Note:

   For the existing customers, we continue to support Basic Authentication to ensure that the existing child tiles which have basic authentication function as expected. However, if a customer wishes to add OAuth to a child tile, they must not remove the existing Basic Authentication credentials (username and password). While they can replace these values with dummy entries, leaving the fields empty will prevent the tile from being submitted successfully.
5. Click Submit.

Result

After you successfully validate and submit the configuration, the Proofpoint DLP Integration is saved on the Security Integrations page as a tile.

• Configure the Webhook on the Proofpoint DLP tenant for alert notifications to ServiceNow
  Configure a webhook on Proofpoint using the REST API endpoint to start getting the alerts from the Proofpoint DLP tenant. Your ServiceNow instance creates DLP incidents from these alerts. The Proofpoint DLP integration provides a REST API endpoint for end users to configure the webhook.