Panther high experimental python

Proofpoint Malware Detected

This rule alerts when Proofpoint detects malware in an email message. It triggers when emails are quarantined with the malware rule or when the malware score is 90 or higher. Events quarantined to the Virus folder or with the notcleaned rule are handled by the Virus Detected rule instead.

View Source

Detection Logic

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Exclude events already handled by the Virus Detected rule
    if event.get("quarantineFolder") == "Virus" or event.get("quarantineRule") == "notcleaned":
        return False
    return event.get("quarantineRule") == "malware" or event.get("malwareScore", 0) >= 90


def severity(event):
    malware_score = event.get("malwareScore", 0)

    if malware_score >= 95:
        return "CRITICAL"
    if malware_score >= 90:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Malware Detected in Email from {sender} " f"- [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related malware alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_rule = event.get("quarantineRule", "malware")
    return f"proofpoint:malware:{sender}:{quarantine_rule}"


def alert_context(event):
    # Use the common helper and extend with malware-specific fields
    context = proofpoint_alert_context(event)
    context["messageSize"] = event.get("messageSize", 0)
    return context

Field Validations

Loading…

Comments (0)

Loading comments...