IRONCLADHELP CENTERBack to Portal
All docs

Connecting Proofpoint TAP

Overview

Connecting Proofpoint Targeted Attack Protection (TAP) lets Ironclad pull in email threat activity from your Proofpoint account so it shows up alongside your other security data.

Before you start: You'll need administrator access to the Proofpoint TAP dashboard with permission to create a service principal.

Step 1: Create a service principal in Proofpoint

  1. Log in to the Proofpoint TAP dashboard.
  2. Go to Settings > Connected Applications (sometimes shown as Service Principals & Secrets).
  3. Create a new service principal/API credential.
  4. Copy the resulting Principal and Secret — you'll need both in the portal, and the secret is typically shown only once.

Step 2: Connect it in the portal

  1. Log in to the Ironclad portal.
  2. Make sure the correct customer is selected in the scope bar at the top.
  3. In the left sidebar, under Administration, click Integrations.
  4. Find the Proofpoint card and fill in:
Field Enter the Proofpoint value for…
Principal Service Principal
Secret Secret
  1. Check the Enabled checkbox.
  2. Click Save. You'll see a brief Saved confirmation.

These fields are write-only credentials. Once saved, the portal shows a mask plus only the final three characters, so you can confirm which value is configured without exposing the full credential. Re-enter a field only when rotating that credential.

Step 3: Confirm it's working

Once saved and enabled, Ironclad begins pulling Proofpoint TAP activity on a regular interval. Check your Ironclad SIEM dashboard for Proofpoint events to confirm data is flowing — it can take a little while for the first events to appear.

Troubleshooting

  • No data after saving: double-check the Principal and Secret were copied exactly, with no extra whitespace.
  • Authorization errors: confirm the service principal in Proofpoint is still active and hasn't been revoked or expired.