Skip to content

fix(SocFrameworkProofPointTap): XSIAM AI modeling rule + schema types - #1159

Merged
scottbrumley merged 1 commit into
mainfrom
fix/proofpoint-tap-ai-modeling-rule
Sep 20, 2026
Merged

scottbrumley merged 1 commit into
mainfrom
fix/proofpoint-tap-ai-modeling-rule

Conversation

@scottbrumley

Copy link
Copy Markdown
Contributor

fix(SocFrameworkProofPointTap): XSIAM AI modeling rule + schema types

Replaces the single-field modeling rule with the XSIAM AI-generated model
(UUID b99ae8b8, 2026-09-19), carried verbatim. That model was generated
against real tenant payloads.

Schema

  • messageTime / clickTime declared datetime, not string.
  • messageParts / threatsInfoMap declared string, not json.
  • toAddresses added; the rule reads it and it was never declared.
    These types are what the install validator requires. With the old types the
    pack fails to install with 101704 while the Data Model Rules editor accepts
    the same XQL. The rule body was never the problem.

Rename

  • id ProofpointTAP_modeling_rule -> SOCFW_ProofpointTAP_v2_ModelingRule,
    name -> "SOC Proofpoint TAP v2 Modeling Rule", directory to match.
    Naming only: three rules shared the display name "ProofpointTAP Modeling
    Rule", and POST_CONFIG Step 4 already refers to the SOC-scoped name.

Also

  • ReleaseNotes/1.3.2.md -> 1_3_2.md; the SDK expects X_Y_Z.md.
  • Three fields appended to the AI output: xdm.session_context_id,
    xdm.target.url, xdm.email.delivery_timestamp.

check_contribution passes including the upload step.

Replaces the single-field modeling rule with the XSIAM AI-generated model
(UUID b99ae8b8, 2026-09-19), carried verbatim. That model was generated
against real tenant payloads.

Schema
- messageTime / clickTime declared datetime, not string.
- messageParts / threatsInfoMap declared string, not json.
- toAddresses added; the rule reads it and it was never declared.
These types are what the install validator requires. With the old types the
pack fails to install with 101704 while the Data Model Rules editor accepts
the same XQL. The rule body was never the problem.

Rename
- id ProofpointTAP_modeling_rule -> SOCFW_ProofpointTAP_v2_ModelingRule,
  name -> "SOC Proofpoint TAP v2 Modeling Rule", directory to match.
  Naming only: three rules shared the display name "ProofpointTAP Modeling
  Rule", and POST_CONFIG Step 4 already refers to the SOC-scoped name.

Also
- ReleaseNotes/1.3.2.md -> 1_3_2.md; the SDK expects X_Y_Z.md.
- Three fields appended to the AI output: xdm.session_context_id,
  xdm.target.url, xdm.email.delivery_timestamp.

check_contribution passes including the upload step.
@scottbrumley scottbrumley added the version:minor New content or playbook → x.N.0 label Sep 20, 2026
@scottbrumley
scottbrumley merged commit f477e48 into main Sep 20, 2026
14 of 24 checks passed
@scottbrumley
scottbrumley deleted the fix/proofpoint-tap-ai-modeling-rule branch September 20, 2026 01:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

version:minor New content or playbook → x.N.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant