{
    "version": "1.0",
    "name": "Proofpoint Threat Response",
    "type": "REST_EVENT",
    "vendor_identifier": "Proofpoint",
    "event_type": ["RPZ"],
    "content_type": "application/json",
    "steps": [
        {
            "name": "postsomething",
            "operation": "POST",
            "transport": {
                "path": ""
            },
            "body_list": [
                "{\"target\": ${E::source_ip},",
                "\"category\": \"malware\",",
                "\"url\": ${E::query_name},",
                "\"severity\": ${E::rpz_severity}}"
            ]
        }
    ]
}