Proofpoint Essentials

LAST UPDATED: NOV 1, 2024

Overview

Proofpoint Essentials provides organizations with comprehensive protection against unwanted and malicious email. Proofpoint Essentials will prevent virus-affected and potential spam emails from reaching the inboxes of the organization users. This integration offers sender list management commands, including read, update and delete organization/group sender lists.

D3 SOAR is providing REST operations to function with Proofpoint Essentials.

Proofpoint Essentials is available for use in:

D3 SOAR	V15.4.4.0+
Category	Email & Messaging
Deployment Options	Option II, Option IV

Connection

To connect to Proofpoint Essentials from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The URL of the Proofpoint Essentials server.	https://*.*.com/*
User Name	The user name for authentication. The domain name of the user's email address will be used as the default domain name for the connection. Note: The role of the user should be Admin (Channel, Organization) to make API calls.	***@***.com
Password	The password for authentication.	PASSWORD
API Version	The version of the API to use for the connection.	v1

Configuring Proofpoint Essentials to Work with D3 SOAR

Log in to Proofpoint Essentials with an admin account.
Navigate to User Management > Users > Add A User.
Complete the required fields with the necessary information. Assign the "Organization Admin" role to the new user. Ensure that the "Read-Only User" option remains unchecked.

Configuring D3 SOAR to Work with Proofpoint Essentials

Log in to D3 SOAR.
Find the Proofpoint Essentials integration.

a. Navigate to Configuration on the top header menu.

b. Click on the Integration icon on the left sidebar.

c. Type Proofpoint Essentials in the search box to find the integration, then click it to select it.

d. Click + Connection, on the right side of the Connections section. A new connection window will appear.

Configure the following fields to create a connection to Proofpoint Essentials.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input the Server URL.
  2. Input your admin account's User Name.
  3. Input the password for the account.
  4. Input the API Version. The default value is v1.
10. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tick box. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

Proofpoint Essentials includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Proofpoint Essentials API, please refer to the Proofpoint Essentials API reference.

READER NOTE

Please refer to the Configuring Proofpoint Essentials to Work with D3 SOAR for details.

Add Group Sender Lists

Adds sender list items (i.e., sender list and blocked list) for the specified group.

Input

Input Parameter	Required/Optional	Description	Example
Group ID	Required	The ID of the group to update sender lists. To locate the Group ID, access the Proofpoint Essentials and navigate to User Management > Groups. Select the desired group to modify sender lists. The Group ID is found in the URL of the group's page. For example, if the URL is "https://*.*.com//index01.php?mod_id=10=groups=**=pr", the Group ID is the numeric value, in this case, "***".	*****
Safe List Items	Optional	The safe list items to add to the group's safe sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted. Each item can only exist in either the Safe List or the Blocked List, but not both, and items already present in any of the sender lists cannot be re-added. Additionally, you must input at least one item in either the "Safe List Items" or "Blocked List Items" parameter.	[ "***@*.com", "*@*.com", "...**" ]
Blocked List Items	Optional	The blocked list items to add to the group's blocked sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted. Each item can only exist in either the Safe List or the Blocked List, but not both, and items already present in any of the sender lists cannot be re-added. Additionally, you must input at least one item in either the "Safe List Items" or "Blocked List Items" parameter.	[ "***@*.com", "*@*.com", "...**" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***/**"
    ],
    "block_list": [
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
    "*****@*****.com",
    "*****@*****.com",
    "***.***.***.***/**"
    ],
    "BlockedList": [
    "*****@*****.com",
    "*****@*****.com",
    "***.***.***.***"
    ] 
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add Group Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 422.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Error Sample Data

Add Group Sender Lists failed.

Status Code: 422.

Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Add Organization Sender Lists

Adds sender list items (i.e., sender list and blocked list) for the organization.

Input

Input Parameter

Required/Optional

Description

Example

Safe List Items

Optional

The safe list items to add to the organization's safe sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted.

Each item can only exist in either the Safe List or the Blocked List, but not both, and items already present in any of the sender lists cannot be re-added. Additionally, you must input at least one item in either the "Safe List Items" or "Blocked List Items parameter".

[

"*****@*****.com",

"***.***.***.***"

]

Blocked List Items

Optional

The blocked list items to add to the organization's blocked sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted.

Each item can only exist in either the Safe List or the Blocked List, but not both, and items already present in any of the sender lists cannot be re-added. Additionally, you must input at least one item in either the "Safe List Items" or "Blocked List Items" parameter.

[

"*****@*****.com",

"***.***.***.***"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ],
    "block_list": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
    "*****@*****.com",
    "*****@*****.com",
    "*****@*****.com",
    "***.***.***.***"
    ],
    "BlockedList": [
    "*****@*****.com",
    "*****@*****.com",
    "*****@*****.com",
    "***.***.***.***"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add Organization Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 422.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Error Sample Data

Add Organization Sender Lists failed.

Status Code: 422.

Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Delete Group Sender Lists

Deletes sender list items (i.e., sender list and blocked list) from the specified group.

Input

Input Parameter	Required/Optional	Description	Example
Group ID	Required	The ID of the group to remove sender lists. To locate the Group ID, access the Proofpoint Essentials and navigate to User Management > Groups. Select the desired group to modify sender lists. The Group ID is found in the URL of the group's page. For example, if the URL is "https://*.*.com/*/index01.php?mod_id=10=groups=[GROUP_ID]=pr", the Group ID is the numeric value.	******
Safe List Items to Delete	Optional	The safe list items to remove from the group's safe sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted. Each item can only exist in either the Safe List or the Blocked List, but not both, and non-existing items in any of the sender lists cannot be deleted. If both existing and non-existing items are provided in the "Safe List Items to Delete" parameter, only the existing ones will be removed. If none of the submitted items exist, an error message will be returned. Additionally, you must input at least one item in either the "Safe List Items to Delete" or "Blocked List Items to Delete" parameter.	[ "***@***.com" ]
Blocked List Items to Delete	Optional	The blocked list items to remove from the group's blocked sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted. Each item can only exist in either the Safe List or the Blocked List, but not both, and non-existing items in any of the sender lists cannot be deleted. If both existing and non-existing items are provided in the "Safe List Items to Delete" parameter, only the existing ones will be removed. If none of the submitted items exist, an error message will be returned. Additionally, you must input at least one item in either the "Safe List Items to Delete" or "Blocked List Items to Delete" parameter.	[ "***@*.com", "*@*.com", "...**" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com",
        "***.***.***.***/**"
    ],
    "block_list": [
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
        "*****@*****.com",
        "***.***.***.***/**"
    ],
    "BlockedList": [
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Delete Group Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 422.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Error Sample Data

Delete Group Sender Lists failed.

Status Code: 422.

Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Delete Organization Sender Lists

Deletes sender list items (i.e., sender list and blocked list) from the organization.

Input

Input Parameter

Required/Optional

Description

Example

Safe List Items to Delete

Optional

The safe list items to remove from the organization's safe sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted.

Each item can only exist in either the Safe List or the Blocked List, but not both, and non-existing items in any of the sender lists cannot be deleted. If both existing and non-existing items are provided in the "Safe List Items to Delete" parameter, only the existing ones will be removed. If none of the submitted items exist, an error message will be returned. Additionally, you must input at least one item in either the "Safe List Items or Blocked List Items" parameter.

[

"*****@*****.com"

]

Blocked List Items to Delete

Optional

The blocked list items to remove from the organization's blocked sender list. Acceptable inputs include patterns of email addresses, domain names, IP addresses, or CIDR addresses. Wildcard characters are permitted.

Each item can only exist in either the Safe List or the Blocked List, but not both, and non-existing items in any of the sender lists cannot be deleted. If both existing and non-existing items are provided in the "Safe List Items to Delete" parameter, only the existing ones will be removed. If none of the submitted items exist, an error message will be returned. Additionally, you must input at least one item in either the "Safe List Items to Delete" or "Blocked List Items to Delete" parameter.

[

"*****@*****.com"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com",
        "***.***.***.***"
    ],
    "block_list": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
        "*****@*****.com",
        "***.***.***.***"
    ],
    "BlockedList": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Delete Organization Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 422.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Error Sample Data

Delete Organization Sender Lists failed.

Status Code: 422.

Message: Unprocessable Entity: allow_list - The allow list field is required., block_list - The block list field is required.

Get All Organization Domains

Retrieves all domains associated with the organization.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "domains": [
        {
            "name": "*****.com",
            "is_active": false,
            "is_relay": true,
            "destination": "",
            "failovers": []
        },
        {
            "name": "*****.com",
            "is_active": true,
            "is_relay": true,
            "destination": "*****.outlook.com",
            "failovers": []
        }
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "DomainNames": [
      "*****.com",
      "*****.com"
    ],
    "IsActive": [
      false,
      true
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get All Organization Domains failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized.

Error Sample Data

Get All Organization Domains failed.

Status Code: 401.

Message: Unauthorized.

Get Group Sender Lists

Retrieves sender lists items(i.e., safe list and blocked list) from the specified group.

Input

Input Parameter

Required/Optional

Description

Example

Group ID

Required

*****

The ID of the group to retrieve sender lists. To locate the Group ID, access the Proofpoint Essentials and navigate to User Management > Groups. Select the desired group to modify sender lists. The Group ID is found in the URL of the group's page. For example, if the URL is "https://***.*****.com/***/index01.php?mod_id=10=groups=[GROUP_ID]=pr", the Group ID is the numeric value.

*****

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com"
    ],
    "block_list": [
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
        "*****@*****.com"
    ],
    "BlockedList": [
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Group Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: The value for parameter (Group ID) is invalid.

Error Sample Data

Get Group Sender Lists failed.

Status Code: 400.

Message: The value for parameter (Group ID) is invalid.

Get Organization Sender Lists

Retrieves sender list items(i.e., safe list and blocked list) from the organization.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "allow_list": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ],
    "block_list": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Key Field

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "SafeList": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ],
    "BlockedList": [
        "*****@*****.com",
        "*****@*****.com",
        "*****@*****.com",
        "***.***.***.***"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Organization Sender Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized.

Error Sample Data

Get Organization Sender Lists failed.

Status Code: 401.

Message: Unauthorized.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Proofpoint Essentials portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized.