---
url: https://docs.realmsec.info/integration/proofpoint.md
---

# Proofpoint TAP Integration

![Proofpoint TAP Architecture](../images/proofpoint.png)

### Send Proofpoint TAP Email Threat Events to Realm

This guide walks you through connecting [Proofpoint TAP](https://www.proofpoint.com/us/products/advanced-threat-protection/targeted-attack-protection) to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Proofpoint TAP SIEM API to retrieve email threat events, then forwards them through your data pipeline to your configured destination.

## Prerequisites

* An active Proofpoint TAP account with administrator access
* Access to the Realm Security console

## Generate API Credentials in Proofpoint TAP

1. Log in to the Proofpoint TAP dashboard.
2. Navigate to **Settings**.
3. Click **New Token** to generate API credentials.
4. Enter a name for the token and click **Generate**.

> **Important:** Copy and save the **Token Service Principal** and **Token Secret** immediately — you will not be able to view them again. You will need both values when configuring the integration in Realm.

## Configure the Integration in Realm

1. Create a new Source.
   > **Name:** `Proofpoint TAP`
2. Add a new Input feed.
   > **Type:** `Proofpoint TAP`\
   > **Service Principal:** `<your Proofpoint TAP Token Service Principal>`\
   > **Secret:** `<your Proofpoint TAP Token Secret>`

Once saved, the Realm poller will begin retrieving email threat events from the Proofpoint TAP SIEM API at regular intervals. The data is forwarded through your data pipeline to your configured destination (e.g., SIEM).

> **Note:** The Realm source will fetch events from the `https://tap-api-v2.proofpoint.com/v2/siem/all`. For more details, refer to the [Proofpoint TAP SIEM API documentation](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API).