From 5fd9b6036409e361ce203273064460f44d0020b2 Mon Sep 17 00:00:00 2001
From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com>
Date: Fri, 16 Feb 2024 14:09:44 +0530
Subject: [PATCH] Update proofpoint-protection-server-panel.yaml

---
 .../proofpoint-protection-server-panel.yaml   | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/http/exposed-panels/proofpoint-protection-server-panel.yaml b/http/exposed-panels/proofpoint-protection-server-panel.yaml
index 382ae62b6a..05e23a1539 100644
--- a/http/exposed-panels/proofpoint-protection-server-panel.yaml
+++ b/http/exposed-panels/proofpoint-protection-server-panel.yaml
@@ -12,31 +12,32 @@ info:
   metadata:
     verified: true
     max-request: 1
-    shodan-query: http.favicon.hash:942678640
     vendor: proofpoint
     product: proofpoint protection server
-  tags: panel,proofpoint
+    shodan-query: http.favicon.hash:942678640
+  tags: panel,proofpoint,login,detect
 
 http:
   - method: GET
     path:
+      - "{{BaseURL}}"
       - "{{BaseURL}}/euweb/login"
 
+    stop-at-first-match: true
     host-redirects: true
     max-redirects: 2
 
-    matchers-condition: and
+    matchers-condition: or
     matchers:
       - type: word
+        part: body
         words:
-          - '<TITLE>Proofpoint Protection Server</TITLE>'
-        condition: and
+          - '<TITLE>Proofpoint Protection Server'
+          - 'Proofpoint End User Application.'
+          - 'Powered by Proofpoint'
+        condition: or
 
       - type: word
         part: header
         words:
-          - "PPSAUTH"
-
-      - type: status
-        status:
-          - 200
+          - 'PPSAUTH='