Proofpoint TAP v2

Use the Proofpoint Targeted Attack Protection (TAP) integration to protect against and provide additional visibility into phishing and other malicious email attacks.

Email · Proofpoint TAP

Details

IDProofpoint TAP v2
ProviderThoma Bravo
CategoryEmail
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Proofpoint TAP

Use the Proofpoint Targeted Attack Protection (TAP) integration to protect against and provide additional visibility into phishing and other malicious email attacks.
This integration was integrated and tested with version v2 of Proofpoint TAP v2

Events Fetch Look-Back

Proofpoint’s SIEM API does not always index events the moment they occur. Indexing can lag by up to ~30 minutes, so an event that already happened may not yet be returned when the integration queries for it in real time. Without a safety mechanism, these late-indexed events can be permanently missed.

The Events Fetch Look-Back (minutes) parameter solves this by overlapping fetch cycles:

  • Why it’s needed: Compensates for the SIEM API indexing delay so events that are indexed after their occurrence time are still collected.
  • How it works: On every fetch cycle the integration requeries the previous N minutes. Built-in deduplication ensures events already fetched are not ingested again, so no duplicates are created.
  • Recommended usage: A value of 30 minutes generally covers the typical indexing delay. Set it to 0 to disable look-back entirely.
  • Existing instances: For instances that were already configured before version 1.3.0, the look-back window is rolled out gradually rather than all at once. This prevents duplicate events from being created when look-back is first applied against historical data that was already fetched. No action is required on your part — the behavior is automatic and safe.

Configure Proofpoint TAP v2 in Cortex

Parameter Description Required
Server URL e.g., https://tap-api-v2.proofpoint.com True
Service Principal The password refers to secret True
API Version v1 is deprecated for new instances. The current API version is v2. False
Trust any certificate (not secure)   False
Use system proxy settings   False
Threat type A string specifying which threat type to return. If empty, all threat types are returned. Can be “url”, “attachment”, or “messageText”. False
Threat status A string specifying which threat statuses to return. If empty, will return “active” and “cleared” threats. Can be “active”, “cleared”, or “falsePositive”. False
Events to fetch   False
Maximum number of incident per fetch   False
First fetch time range First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Proofpoint supports a maximum 1 week fetch back. False
Advanced: Raw message encoding The character encoding to apply on the message fetched (e.g. latin-1). Advanced configuration to be used only if instructed by XSOAR Support False
Events Fetch Look-Back (minutes) The number of minutes to look back during each fetch to handle the Proofpoint SIEM API indexing delay (up to 30 minutes). When set, each fetch cycle requeries the previous N minutes to catch late-indexing events that would otherwise be missed. Duplicates are filtered automatically. Set to 0 to disable. False
Fetch incidents   False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

proofpoint-get-events

Fetches events for all clicks and messages relating to known threats within the specified time period. Details as per clicks/blocked.

Base Command

proofpoint-get-events

Input

Argument Name Description Required
interval A string containing an ISO8601-formatted interval. If this interval overlaps with previous requests for data, records from the previous request might be duplicated. The minimum interval is thirty seconds. The maximum interval is one hour. Examples: 2016-05-01T12:00:00Z/2016-05-01T13:00:00Z - an hour interval, beginning at noon UTC on 05-01-2016 PT30M/2016-05-01T12:30:00Z - the thirty minutes beginning at noon UTC on 05-01-2016 and ending at 12:30pm * UTC 2016-05-01T05:00:00-0700/PT30M - the same interval as above, but using -0700 as the time zone. Optional
threatType A comma-separated list of the threat types to return. If empty, all threat types are returned. The following values are accepted: “url”, “attachment”, and “messageText”. Possible values are: url, attachment, messageText. Optional
threatStatus A string specifying which threat statuses to return. If empty, active and cleared threats are returned. Can be “active”, “cleared”, “falsePositive”. Possible values are: active, cleared, falsePositive. Optional
sinceTime A string containing an ISO8601 date. It represents the start of the data retrieval period. The end of the period is determined by the current API server time rounded to the nearest minute. If JSON output is selected, the end time is included in the returned result. Example: 2016-05-01T12:00:00Z. Optional
sinceSeconds An integer representing a time window (in seconds) from the current API server time. The start of the window is the current API server time, rounded to the nearest minute, less the number of seconds provided. The end of the window is the current API server time rounded to the nearest minute. If JSON output is selected, the end time is included in the returned result. Optional
eventTypes Event types to return. Possible values: “All”, “Issues”, “Delivered Messages”, “Blocked Messages”, “Permitted Clicks”, and “Blocked Clicks”. Possible values are: All, Issues, Delivered Messages, Blocked Messages, Permitted Clicks, Blocked Clicks. Default is All. Optional

Context Output

Path Type Description
Proofpoint.MessagesDelivered.GUID String The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
Proofpoint.MessagesDelivered.QID String The queue ID of the message within PPS. It can be used to identify the message in PPS, which is not unique.
Proofpoint.MessagesDelivered.ccAddresses String A list of email addresses contained within the CC: header, excluding any friendly names.
Proofpoint.MessagesDelivered.clusterId String The name of the PPS cluster which processed the message.
Proofpoint.MessagesDelivered.fromAddress String The email address contained in the From: header, excluding any friendly name.
Proofpoint.MessagesDelivered.headerCC String The CC header.
Proofpoint.MessagesDelivered.headerFrom String The full content of the From: header, including any friendly name.
Proofpoint.MessagesDelivered.headerReplyTo String If present, the full content of the Reply-To: header, including any friendly names.
Proofpoint.MessagesDelivered.impostorScore Number The impostor score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.malwareScore Number The malware score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.messageId String Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS, which is not unique.
Proofpoint.MessagesDelivered.threatsInfoMap.threat String The artifact which was condemned by Proofpoint. The malicious URL, hash of the attachment threat, or email address of the impostor sender.
Proofpoint.MessagesDelivered.threatsInfoMap.threatId String The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
Proofpoint.MessagesDelivered.threatsInfoMap.threatStatus String The current state of the threat (active, expired, false-positive, cleared).
Proofpoint.MessagesDelivered.threatsInfoMap.threatTime Date The time Proofpoint assigned the threatStatus (ISO8601 format).
Proofpoint.MessagesDelivered.threatsInfoMap.threatType String Whether the threat was an attachment, URL, or message type.
Proofpoint.MessagesDelivered.threatsInfoMap.threatUrl String A link to the entry about the threat on the TAP Dashboard.
Proofpoint.MessagesDelivered.messageTime Date The time the message was delivered to the user or quarantined by PPS.
Proofpoint.MessagesDelivered.modulesRun String The list of PPS modules that processed the message.
Proofpoint.MessagesDelivered.phishScore Number The phishing score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.policyRoutes String The policy routes that the message matched during processing by PPS.
Proofpoint.MessagesDelivered.quarantineFolder String The name of the folder that contains the quarantined message. This appears only for messagesBlocked.
Proofpoint.MessagesDelivered.quarantineRule String The name of the rule that quarantined the message. This appears only for messagesBlocked events.
Proofpoint.MessagesDelivered.recipient String A list containing the email addresses of the recipients.
Proofpoint.MessagesDelivered.replyToAddress String The email address contained in the Reply-To: header, excluding any friendly name.
Proofpoint.MessagesDelivered.sender String The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.MessagesDelivered.senderIP String The IP address of the sender.
Proofpoint.MessagesDelivered.spamScore Number The spam score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.subject String The subject line of the message, if available.
Proofpoint.MessagesBlocked.GUID String The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
Proofpoint.MessagesBlocked.QID String The queue ID of the message within PPS. It can be used to identify the message in PPS, which is not unique.
Proofpoint.MessagesBlocked.ccAddresses String A list of email addresses contained within the CC: header, excluding any friendly names.
Proofpoint.MessagesBlocked.clusterId String The name of the PPS cluster that processed the message.
Proofpoint.MessagesBlocked.fromAddress String The email address contained in the From: header, excluding any friendly name.
Proofpoint.MessagesBlocked.headerCC String The CC header.
Proofpoint.MessagesBlocked.headerFrom String The full content of the From: header, including any friendly name.
Proofpoint.MessagesBlocked.headerReplyTo String If present, the full content of the Reply-To: header, including any friendly names.
Proofpoint.MessagesBlocked.impostorScore Number The impostor score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.malwareScore Number The malware score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.messageId String Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS, which is not unique.
Proofpoint.MessagesBlocked.threatsInfoMap.threat String The artifact which was condemned by Proofpoint. The malicious URL, hash of the attachment threat, or email address of the impostor sender.
Proofpoint.MessagesBlocked.threatsInfoMap.threatId String The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
Proofpoint.MessagesBlocked.threatsInfoMap.threatStatus String The current state of the threat (active, expired, false-positive, cleared).
Proofpoint.MessagesBlocked.threatsInfoMap.threatTime Date The time Proofpoint assigned the threatStatus (ISO8601 format).
Proofpoint.MessagesBlocked.threatsInfoMap.threatType String Whether the threat was an attachment, URL, or message type.
Proofpoint.MessagesBlocked.threatsInfoMap.threatUrl String A link to the entry about the threat on the TAP dashboard.
Proofpoint.MessagesBlocked.messageTime Date The time the message was blocked to the user or quarantined by PPS.
Proofpoint.MessagesBlocked.messageTime String The list of PPS modules that processed the message.
Proofpoint.MessagesBlocked.modulesRun String The list of PPS modules that processed the message.
Proofpoint.MessagesBlocked.phishScore Number The phishing score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.policyRoutes String The policy routes that the message matched during processing by PPS.
Proofpoint.MessagesBlocked.quarantineFolder String The name of the folder that contains the quarantined message. This appears only for messagesBlocked.
Proofpoint.MessagesBlocked.quarantineRule String The name of the rule that quarantined the message. This appears only for messagesBlocked events.
Proofpoint.MessagesBlocked.recipient String A list containing the email addresses of the recipients.
Proofpoint.MessagesBlocked.replyToAddress String The email address contained in the Reply-To: header, excluding any friendly name.
Proofpoint.MessagesBlocked.sender String The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.MessagesBlocked.senderIP String The IP address of the sender.
Proofpoint.MessagesBlocked.spamScore Number The spam score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.subject String The subject line of the message, if available.
Proofpoint.ClicksPermitted.GUID String The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
Proofpoint.ClicksPermitted.campaignId String An identifier for the campaign of which the threat is a member, if available at the time of the query. Threats can be linked to campaigns even after these events are retrieved.
Proofpoint.ClicksPermitted.classification String The threat category of the malicious URL.
Proofpoint.ClicksPermitted.clickIP String The external IP address of the user who clicked the link. If the user is behind a firewall performing network address translation, the IP address of the firewall will be shown.
Proofpoint.ClicksPermitted.clickTime Date The time the user clicked the URL.
Proofpoint.ClicksPermitted.messageID String The Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS and is not unique.
Proofpoint.ClicksPermitted.recipient String The email address of the recipient.
Proofpoint.ClicksPermitted.sender String The email address of the sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.ClicksPermitted.senderIP String The IP address of the sender.
Proofpoint.ClicksPermitted.threatID String The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
Proofpoint.ClicksPermitted.threatTime Date The time Proofpoint identified the URL as a threat.
Proofpoint.ClicksPermitted.threatURL String A link to the entry on the TAP Dashboard for the particular threat.
Proofpoint.ClicksPermitted.url String The malicious URL which was clicked.
Proofpoint.ClicksPermitted.userAgent String The User-Agent header from the clicker’s HTTP request.
Proofpoint.ClicksBlocked.GUID String The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
Proofpoint.ClicksBlocked.campaignId String An identifier for the campaign of which the threat is a member, if available at the time of the query. Threats can be linked to campaigns even after these events are retrieved.
Proofpoint.ClicksBlocked.classification String The threat category of the malicious URL.
Proofpoint.ClicksBlocked.clickIP String The external IP address of the user who clicked the link. If the user is behind a firewall performing network address translation, the IP address of the firewall will be shown.
Proofpoint.ClicksBlocked.clickTime Date The time the user clicked the URL.
Proofpoint.ClicksBlocked.messageID String Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS and is not unique.
Proofpoint.ClicksBlocked.recipient String The email address of the recipient.
Proofpoint.ClicksBlocked.sender String The email address of the sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.ClicksBlocked.senderIP String The IP address of the sender.
Proofpoint.ClicksBlocked.threatID String The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
Proofpoint.ClicksBlocked.threatTime Date The time Proofpoint identified the URL as a threat.
Proofpoint.ClicksBlocked.threatURL String A link to the entry on the TAP dashboard for the particular threat.
Proofpoint.ClicksBlocked.url String The malicious URL that was clicked.
Proofpoint.ClicksBlocked.userAgent String The User-Agent header from the clicker’s HTTP request.

Command Example

!proofpoint-get-events interval="2021-06-07T02:00:00Z/2021-06-07T03:00:00Z"

Context Example

{
    "Proofpoint": {
        "ClicksBlocked": null,
        "ClicksPermitted": null,
        "MessagesBlocked": [
            {
                "GUID": "9JRzwqiZEzBesdfnEM48ItsowO9ZJ1jmBbo",
                "QID": "3901vhsdfsdfg0q5d-1",
                "ccAddresses": [],
                "cluster": "hosted",
                "completelyRewritten": false,
                "fromAddress": [
                    "xxxx@xxx.com"
                ],
                "headerFrom": "\"xxxx@xxx.com\" <xxxx@xxx.com>",
                "headerReplyTo": null,
                "id": "867899c4-bbbvnvde-9948-fxv0a2-740c13aafb98",
                "impostorScore": 0,
                "malwareScore": 0,
                "messageID": "<98fd30b9-b15b-b883-ca4xcvxvc8-3a0dsfsf766719bc4@xxxx@xxx.com>",
                "messageParts": [
                    {
                        "contentType": "text/html",
                        "disposition": "inline",
                        "filename": "text.html",
                        "md5": "af671999d59182d8e66e100d4140b577",
                        "oContentType": "text/html",
                        "sandboxStatus": null,
                        "sha256": "99e2546be00c1c2a763a51861dfgf6b2981871051843dc18542ba1417b0b464c00f"
                    }
                ],
                "messageSize": 3684,
                "messageTime": "2021-06-07T01:50:00.000Z",
                "modulesRun": [
                    "av",
                    "spf",
                    "dkimv",
                    "spam",
                    "dmarc",
                    "pdr",
                    "urldefense"
                ],
                "phishScore": 100,
                "policyRoutes": [
                    "default_inbound"
                ],
                "quarantineFolder": "Phish",
                "quarantineRule": "inbound_spam_phish",
                "recipient": [
                    "xxxx@xxx.com"
                ],
                "replyToAddress": [],
                "sender": "xxxx@xxx.com",
                "senderIP": "000.000.000.000",
                "spamScore": 100,
                "subject": "Your mailbox is full......",
                "threatsInfoMap": [
                    {
                        "campaignID": null,
                        "classification": "phish",
                        "threat": "io/login/verify",
                        "threatID": "9a53601a616eb78609e525sdfsdfc0f73356c3d9ff80f00e782105ff08c53ee5a3cfca",
                        "threatStatus": "active",
                        "threatTime": "2021-06-07T00:47:12.000Z",
                        "threatType": "url",
                        "threatUrl": "https://threatinsight.proofpoint.com"
                    }
                ],
                "toAddresses": [
                    "xxxx@xxx.com"
                ],
                "xmailer": null
            }
        ],
        "MessagesDelivered": null
    }
}

Human Readable Output

Proofpoint Events

clicksBlocked clicksPermitted messagesBlocked messagesDelivered queryEndTime
    {‘spamScore’: 100, ‘phishScore’: 100, ‘threatsInfoMap’: [{‘threatID’: ‘9a53601a616eb78609e525c0f73356c3d9ff80f00e782105ff08c53ee5a3cfca’, ‘threatStatus’: ‘active’, ‘classification’: ‘phish’, ‘threatUrl’: ‘https://threatinsight.proofpoint.com’, ‘threatTime’: ‘2021-06-07T00:47:12.000Z’, ‘threat’: ‘storage.libertychurch9848737878.io/login/verify’, ‘campaignID’: None, ‘threatType’: ‘url’}, {‘threatID’: ‘b72f9ac2cec86c5f2fb795ea47f2aea23d402fe46c5c64e2565363464b1b0eb2’, ‘threatStatus’: ‘active’, ‘classification’: ‘phish’, ‘threatUrl’: ‘https://threatinsight.proofpoint.com/1c863185-589c-ad2d-49cb-0020fe555aae/threat/email/b72f9ac2cec86c5f2fb795ea47f2aea23d402fe46c5c64e2565363464b1b0eb2’, ‘threatTime’: ‘2021-06-07T00:47:23.000Z’, ‘threat’: ‘libertychurch9848737878.io’, ‘campaignID’: None, ‘threatType’: ‘url’}, {‘threatID’: ‘da0ba8d6a9d5111900f5927eb4554e49fd30e6c5c4ad5b0c975feeb19c3bfc5b’, ‘threatStatus’: ‘active’, ‘classification’: ‘phish’, ‘threatUrl’: ‘https://threatinsight.proofpoint.com/1c863185-589c-ad2d-49cb-0020fe555aae/threat/email/da0ba8d6a9d5111900f5927eb4554e49fd30e6c5c4ad5b0c975feeb19c3bfc5b’, ‘threatTime’: ‘2021-06-07T00:47:22.000Z’, ‘threat’: ‘storage.libertychurch9848737878.io/login/’, ‘campaignID’: None, ‘threatType’: ‘url’}], ‘messageTime’: ‘2021-06-07T01:50:00.000Z’, ‘impostorScore’: 0.0, ‘malwareScore’: 0, ‘cluster’: ‘hosted’, ‘subject’: ‘Your mailbox is full……’, ‘quarantineFolder’: ‘Phish’, ‘quarantineRule’: ‘inbound_spam_phish’, ‘policyRoutes’: [‘default_inbound’], ‘modulesRun’: [‘av’, ‘spf’, ‘dkimv’, ‘spam’, ‘dmarc’, ‘pdr’, ‘urldefense’], ‘messageSize’: 3684, ‘headerFrom’: ‘“xxxx@xxx.com” xxxx@xxx.com’, ‘headerReplyTo’: None, ‘fromAddress’: [‘xxxx@xxx.com’], ‘ccAddresses’: [], ‘replyToAddress’: [], ‘toAddresses’: [‘xxxx@xxx.com’], ‘xmailer’: None, ‘messageParts’: [{‘disposition’: ‘inline’, ‘sha256’: ‘99e2546be00c1c2a763a51861f6b29818710dsfsdf51843dc18542ba1417b0b464c00f’, ‘md5’: ‘af671999d59182d8e66e100d4140b577’, ‘filename’: ‘text.html’, ‘sandboxStatus’: None, ‘oContentType’: ‘text/html’, ‘contentType’: ‘text/html’}], ‘completelyRewritten’: False, ‘id’: ‘867899c4-bbde-9948-f0a2-740c13aafb98’, ‘QID’: ‘3901vhsdvf0q5d-1’, ‘GUID’: ‘9JRzwqisvsdvZEzBenEM48ItsowO9ZJ1jmBbo’, ‘sender’: ‘xxxx@xxx.com’, ‘recipient’: [‘xxxx@xxx.com’], ‘senderIP’: ‘000.000.000.000’, ‘messageID’: ‘xxxx@xxx.com’}    

proofpoint-get-forensics

Returns forensics evidence.

Base Command

proofpoint-get-forensics

Input

Argument Name Description Required
threatId The ID of the threat (use with either threatId or campaignId). Optional
campaignId ID of the campaign (use with either threatId or campaignId). Optional
includeCampaignForensics Whether to include forensic evidence for the whole campaign. Can be used with threatId only. Default is false. Optional

Context Output

Path Type Description
Proofpoint.Report.ID String The ID of the report.
Proofpoint.Report.Type String The threat type. Can be: “attachment”, “url”, or “hybrid”.
Proofpoint.Report.Scope String Whether the report scope covers a campaign or an individual threat.
Proofpoint.Report.Attachment.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Attachment.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Attachment.Display String A friendly display string.
Proofpoint.Report.Attachment.SHA256 String The SHA256 hash of the attachment’s contents.
Proofpoint.Report.Attachment.MD5 String The MD5 hash of the attachment’s contents.
Proofpoint.Report.Attachment.Blacklisted Number Optional. Whether the file was block listed.
Proofpoint.Report.Attachment.Offset Number Optional. The offset in bytes where the malicious content was found.
Proofpoint.Report.Attachment.Size Number Optional. The size in bytes of the attachment’s contents.
Proofpoint.Report.Attachment.Platform.Name String The name of the platform.
Proofpoint.Report.Attachment.Platform.OS String The operating system of the platform.
Proofpoint.Report.Attachment.Platform.Version String The version of the platform.
Proofpoint.Report.Cookie.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Cookie.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Cookie.Display String A friendly display string.
Proofpoint.Report.Cookie.Action String Whether the cookie was set or deleted.
Proofpoint.Report.Cookie.Domain String The domain that set the cookie.
Proofpoint.Report.Cookie.Key String The name of the cookie being set or deleted.
Proofpoint.Report.Cookie.Value String Optional. The content of the cookie being set.
Proofpoint.Report.Cookie.Platform.Name String Name of the platform.
Proofpoint.Report.Cookie.Platform.OS String The operating system of the platform.
Proofpoint.Report.Cookie.Platform.Version String The version of the platform.
Proofpoint.Report.DNS.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.DNS.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.DNS.Display String A friendly display string.
Proofpoint.Report.DNS.Host String The hostname being resolved.
Proofpoint.Report.DNS.CNames String Optional. An array of CNames, which were associated with the hostname.
Proofpoint.Report.DNS.IP String Optional. An array of IP addresses that were resolved to the hostname.
Proofpoint.Report.DNS.NameServers String Optional. The nameservers responsible for the hostname’s domain.
Proofpoint.Report.DNS.NameServersList String Optional. The nameservers responsible for the hostnames.
Proofpoint.Report.DNS.Platform.Name String The name of the platform.
Proofpoint.Report.DNS.Platform.OS String The operating system of the platform.
Proofpoint.Report.DNS.Platform.Version String The version of the platform.
Proofpoint.Report.Dropper.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Dropper.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Dropper.Display String A friendly display string.
Proofpoint.Report.Dropper.Path String The location of the dropper file.
Proofpoint.Report.Dropper.URL String Optional. The name of the static rule inside the sandbox that identified the dropper.
Proofpoint.Report.Dropper.Rule String Optional. The URL the dropper contacted.
Proofpoint.Report.Dropper.Platform.Name String The name of the platform.
Proofpoint.Report.Dropper.Platform.OS String The operating system of the platform.
Proofpoint.Report.Dropper.Platform.Version String The version of the platform.
Proofpoint.Report.File.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.File.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.File.Display String A friendly display string.
Proofpoint.Report.File.Path String Optional. The location of the file operated on.
Proofpoint.Report.File.Action String Optional. The filesystem call made (create, modify, or delete).
Proofpoint.Report.File.Rule String Optional. The name of the static rule inside the sandbox that identified the suspicious file.
Proofpoint.Report.File.SHA256 Unknown Optional. The SH256 hash of the file’s contents.
Proofpoint.Report.File.MD5 String Optional. The MD5 hash of the file’s contents.
Proofpoint.Report.File.Size Number Optional. The size in bytes of the file’s contents.
Proofpoint.Report.File.Platform.Name String The name of the platform.
Proofpoint.Report.File.Platform.OS String The operating system of the platform.
Proofpoint.Report.File.Platform.Version String The version of the platform.
Proofpoint.Report.IDS.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.IDS.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.IDS.Display String A friendly display string.
Proofpoint.Report.IDS.Name String The friendly name of the IDS rule that observed the malicious traffic.
Proofpoint.Report.IDS.SignatureID String The identifier of the IDS rule that observed the malicious traffic.
Proofpoint.Report.IDS.Platform.Name String The name of the platform.
Proofpoint.Report.IDS.Platform.OS String The operating system of the platform.
Proofpoint.Report.IDS.Platform.Version String The version of the platform.
Proofpoint.Report.Mutex.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Mutex.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Mutex.Display String A friendly display string.
Proofpoint.Report.Mutex.Name String The name of the mutex.
Proofpoint.Report.Mutex.Path String Optional. The path to the process which spawned the mutex.
Proofpoint.Report.Mutex.Platform.Name String The name of the platform.
Proofpoint.Report.Mutex.Platform.OS String The operating system of the platform.
Proofpoint.Report.Mutex.Platform.Version String The version of the platform.
Proofpoint.Report.Network.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Network.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Network.Display String A friendly display string.
Proofpoint.Report.Network.Action String The type of network activity being initiated (connect or listen).
Proofpoint.Report.Network.IP String The remote IP address being contacted.
Proofpoint.Report.Network.Port String The remote IP port being contacted.
Proofpoint.Report.Network.Type String The protocol being used (tcp or udp).
Proofpoint.Report.Network.Platform.Name String The name of the platform.
Proofpoint.Report.Network.Platform.OS String The operating system of the platform.
Proofpoint.Report.Network.Platform.Version String The version of the platform.
Proofpoint.Report.Process.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Process.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Process.Display String A friendly display string.
Proofpoint.Report.Process.Action String The action performed on the process. Relevant when create is produced.
Proofpoint.Report.Process.Path String The location of the executable that spawned the process.
Proofpoint.Report.Process.Platform.Name String The name of the platform.
Proofpoint.Report.Process.Platform.OS String The operating system of the platform.
Proofpoint.Report.Process.Platform.Version String The version of the platform.
Proofpoint.Report.Registry.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Registry.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Registry.Display String A friendly display string.
Proofpoint.Report.Registry.Name String Optional. The name of the registry entry being created or set.
Proofpoint.Report.Registry.Action String The registry change made (create or set).
Proofpoint.Report.Registry.Key String The location of the registry key being modified.
Proofpoint.Report.Registry.Value String Optional. The contents of the key being created or set.
Proofpoint.Report.Registry.Platform.Name String The name of the platform.
Proofpoint.Report.Registry.Platform.OS String The operating system of the platform.
Proofpoint.Report.Registry.Platform.Version String The version of the platform.
Proofpoint.Report.URL.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.URL.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.URL.Display String A friendly display string.
Proofpoint.Report.URL.URL String The URL which was observed.
Proofpoint.Report.URL.Blacklisted Boolean Optional. Whether the URL appeared on a block list.
Proofpoint.Report.URL.SHA256 String Optional. The SHA256 hash of the file downloaded from the URL.
Proofpoint.Report.URL.MD5 String Optional. The MD5 hash of the file downloaded from the URL.
Proofpoint.Report.URL.Size Number Optional. The size in bytes of the file retrieved from the URL.
Proofpoint.Report.URL.HTTPStatus Number Optional. The HTTP status code that was produced when our sandbox visited the URL.
Proofpoint.Report.URL.IP String Optional. The IP address that was resolved to the hostname by the sandbox.
Proofpoint.Report.URL.Platform.Name String The name of the platform.
Proofpoint.Report.URL.Platform.OS String The operating system of the platform.
Proofpoint.Report.URL.Platform.Version String The version of the platform.
Proofpoint.Report.Behavior.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Behavior.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Behavior.Display String A friendly display string.
Proofpoint.Report.Behavior.URL String The URL that was observed.
Proofpoint.Report.Behavior.Path String The location of the executable which spawned the behavior.
Proofpoint.Report.Behavior.Platform.Name String The name of the platform.
Proofpoint.Report.Behavior.Platform.OS String The operating system of the platform.
Proofpoint.Report.Behavior.Platform.Version String The version of the platform.
Proofpoint.Report.Behavior.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Behavior.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Behavior.Display String A friendly display string.
Proofpoint.Report.Behavior.URL String The URL that was observed.
Proofpoint.Report.Behavior.Path String The location of the executable that spawned the behavior.
Proofpoint.Report.Behavior.Platform.Name String The name of the platform.
Proofpoint.Report.Behavior.Platform.OS String The operating system of the platform.
Proofpoint.Report.Behavior.Platform.Version String The version of the platform.
Proofpoint.Report.Screenshot.Time Date The relative time at which the evidence was observed during sandboxing.
Proofpoint.Report.Screenshot.Malicious String Whether the evidence was used to reach a malicious verdict.
Proofpoint.Report.Screenshot.Display String A friendly display string.
Proofpoint.Report.Screenshot.URL String The URL hosting the screenshot image.

Command Example

!proofpoint-get-forensics campaignId="35e291e1-c9da-4ebd-b229-538bf759b546"

Context Example

{
    "Proofpoint": {
        "Report": {
            "Attachment": [
                {
                    "Display": "Malicious attachment with SHA-256: 1c207a1ea4b89cc63c2d8391afcf25",
                    "Malicious": true,
                    "Platform": [
                        {
                            "Name": "Win10",
                            "OS": "win",
                            "Version": "win10"
                        }
                    ],
                    "SHA256": "1c207da4b89cc63c2d8391afcf25",
                    "Time": 0
                }
            ]
        }
    }
}

Human Readable Output

Forensic results from ProofPoint for ID: 35e291e1-c9da-4ebd-b229-538bf759b546

ID Scope Type
35e291e1-c9da-4ebd-b229-538bf759b546 CAMPAIGN  

proofpoint-get-events-clicks-blocked

Gets events for clicks to malicious URLs blocked in the specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-get-events-clicks-blocked

Input

Argument Name Description Required
threat_status Click’s threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: ‘active’, ‘cleared’, and ‘falsePositive’. Possible values are: active, cleared, falsePositive. Optional
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.ClicksBlocked.url String The malicious URL was clicked.
Proofpoint.ClicksBlocked.classification String The threat category of the malicious URL (Malware, Phish, or Spam)
Proofpoint.ClicksBlocked.clickTime Date The time the user clicked the URL.
Proofpoint.ClicksBlocked.threatTime Date The time that Proofpoint identified the URL as a threat.
Proofpoint.ClicksBlocked.userAgent String The User-Agent header from the clicker’s HTTP request.
Proofpoint.ClicksBlocked.campaignId String An identifier for the campaign of which the threat is a member.
Proofpoint.ClicksBlocked.id String The unique ID of the click.
Proofpoint.ClicksBlocked.clickIP String The external IP address of the user who clicked the link.
Proofpoint.ClicksBlocked.sender String The email address of the sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.ClicksBlocked.recipient String The email address of the recipient.
Proofpoint.ClicksBlocked.senderIP String The IP address of the sender.
Proofpoint.ClicksBlocked.threatID String The unique identifier associated with this threat.
Proofpoint.ClicksBlocked.threatURL String A link to the entry on the TAP dashboard for the particular threat.
Proofpoint.ClicksBlocked.threatStatus String The current state of the threat.
Proofpoint.ClicksBlocked.messageID String The ID of the message that the URL belongs to.
Proofpoint.ClicksBlocked.GUID String The ID of the message within PPS. It can be used to identify the message in PPS.

Command Example

!proofpoint-get-events-clicks-blocked time_range="1 hour"

Context Example

{
    "Proofpoint": {
        "ClicksBlocked": {
            "campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
            "classification": "MALWARE",
            "clickIP": "192.0.2.2",
            "clickTime": "2010-01-22T00:00:10.000Z",
            "messageID": "4444",
            "recipient": "xxxx@xxx.com",
            "sender": "xxxx@xxx.com",
            "senderIP": "000.000.000.000",
            "threatID": "threat_num2",
            "threatTime": "2010-01-22T00:00:20.000Z",
            "threatURL": "https://threatinsight.proofpoint.com",
            "url": "http://badguy.zz/",
            "userAgent": "Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0"
        }
    }
}

Human Readable Output

Blocked Clicks

Id Sender IP Recipient Classification Threat ID Threat URL Threat Status Threat Time Click Time Campaign Id User Agent
  000.000.000.000 xxxx@xxx.com MALWARE threat_num2 https://threatinsight.proofpoint.com   2010-01-22T00:00:20.000Z 2010-01-22T00:00:10.000Z 46e01b8a-c899-404d-bcd9-189bb393d1a7 Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0

proofpoint-get-events-clicks-permitted

Get events for clicks to malicious URLs permitted in the specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-get-events-clicks-permitted

Input

Argument Name Description Required
threat_status Click’s threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: ‘active’, ‘cleared’, and ‘falsePositive’. Possible values are: active, cleared, falsePositive. Optional
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.ClicksPermitted.url String The malicious URL that was clicked.
Proofpoint.ClicksPermitted.classification String The threat category of the malicious URL (Malware, Phish, or Spam).
Proofpoint.ClicksPermitted.clickTime Date The time the user clicked the URL.
Proofpoint.ClicksPermitted.threatTime Date The time that Proofpoint identified the URL as a threat.
Proofpoint.ClicksPermitted.userAgent String The User-Agent header from the clicker’s HTTP request.
Proofpoint.ClicksPermitted.campaignId String An identifier for the campaign of which the threat is a member.
Proofpoint.ClicksPermitted.id String The unique ID of the click.
Proofpoint.ClicksPermitted.clickIP String The external IP address of the user who clicked the link.
Proofpoint.ClicksPermitted.sender String The email address of the sender. The user-part is hashed. The domain-part is in cleartext.
Proofpoint.ClicksPermitted.recipient String The email address of the recipient.
Proofpoint.ClicksPermitted.senderIP String The IP address of the sender.
Proofpoint.ClicksPermitted.threatID String The unique identifier associated with this threat.
Proofpoint.ClicksPermitted.threatURL String A link to the entry on the TAP dashboard for the particular threat.
Proofpoint.ClicksPermitted.threatStatus String The current state of the threat.
Proofpoint.ClicksPermitted.messageID String The ID of the message that the URL belongs to.
Proofpoint.ClicksPermitted.GUID String The ID of the message within PPS. It can be used to identify the message in PPS.

Command Example

!proofpoint-get-events-clicks-permitted time_range="1 hour"

Context Example

{
    "Proofpoint": {
        "ClicksPermitted": {
            "campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
            "classification": "MALWARE",
            "clickIP": "192.0.2.2",
            "clickTime": "2010-01-22T00:00:10.000Z",
            "messageID": "4444",
            "recipient": "xxxx@xxx.com",
            "sender": "9facbf452def2d7efc5b5c48cdb837fa@badguy.zz",
            "senderIP": "000.000.000.000",
            "threatID": "threat_num2",
            "threatTime": "2010-01-22T00:00:20.000Z",
            "threatURL": "https://threatinsight.proofpoint.com",
            "url": "http://badguy.zz/",
            "userAgent": "Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0"
        }
    }
}

Human Readable Output

Permitted Clicks

Id Sender IP Recipient Classification Threat ID Threat URL Threat Status Threat Time Click Time Campaign Id User Agent
  192.0.2.255 xxxx@xxx.com MALWARE threat_num2 https://threatinsight.proofpoint.com   2010-01-22T00:00:20.000Z 2010-01-22T00:00:10.000Z 46e01b8a-c899-404d-bcd9-189bb393d1a7 Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0

proofpoint-get-events-messages-blocked

Get events for blocked messages in the specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-get-events-messages-blocked

Input

Argument Name Description Required
threat_type Message’s threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: ‘url’, ‘attachment’, and ‘message’. Possible values are: url, attachment, message. Optional
threat_status Message’s threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: ‘active’, ‘cleared’, and ‘falsePositive’. Possible values are: active, cleared, falsePositive. Optional
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.MessagesBlocked.spamScore Number The spam score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.phishScore Number The phish score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.threatsInfoMap List List that contains details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.
Proofpoint.MessagesBlocked.messageTime Date The time the message was delivered to the user or quarantined by PPS.
Proofpoint.MessagesBlocked.impostorScore Number The impostor score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.malwareScore Number The malware score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesBlocked.cluster String The name of the PPS cluster that processed the message.
Proofpoint.MessagesBlocked.subject String The subject line of the message, if available.
Proofpoint.MessagesBlocked.quarantineFolder String The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be ‘None’.
Proofpoint.MessagesBlocked.quarantineRule String The name of the rule that quarantined the message. This appears only for messagesBlocked events.
Proofpoint.MessagesBlocked.policyRoutes List The policy routes that the message matched during processing by PPS.
Proofpoint.MessagesBlocked.modulesRun String The list of PPS modules that processed the message.
Proofpoint.MessagesBlocked.messageSize Number The size in bytes of the message, including headers and attachments.
Proofpoint.MessagesBlocked.Header.headerFrom String The full content of the From header, including any friendly name.
Proofpoint.MessagesBlocked.Header.headerReplyTo String If present, the full content of the Reply-To: header, including any friendly names.
Proofpoint.MessagesBlocked.Header.fromAddress List The email address contained in the From header, excluding the friendly name.
Proofpoint.MessagesBlocked.Header.ccAddresses List A list of email addresses contained within the CC: header, excluding friendly names.
Proofpoint.MessagesBlocked.Header.replyToAddress List The email address contained in the Reply-To: header, excluding friendly name.
Proofpoint.MessagesBlocked.Header.toAddresses List A list of email addresses contained within the To: header, excluding friendly names.
Proofpoint.MessagesBlocked.Header.xmailer String The content of the X-Mailer: header, if present.
Proofpoint.MessagesBlocked.messageParts List An array of structures that contain details about parts of the message, including both message bodies and attachments.
Proofpoint.MessagesBlocked.completelyRewritten String The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is ‘na’, the message did not contain any URL-based threats.
Proofpoint.MessagesBlocked.id String The unique ID of the message.
Proofpoint.MessagesBlocked.sender String The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.MessagesBlocked.recipient List A list containing the email addresses of the recipients.
Proofpoint.MessagesBlocked.senderIP String The IP address of the sender.
Proofpoint.MessagesBlocked.messageID String Message-ID extracted from the headers of the email message.
Proofpoint.MessagesBlocked.GUID String The ID of the message within PPS. It can be used to identify the message in PPS.

Command Example

!proofpoint-get-events-messages-blocked interval="2021-06-07T02:00:00Z/2021-06-07T03:00:00Z"

Context Example

{
    "Proofpoint": {
        "MessagesBlocked": [
            {
                "GUID": "9JRzwqiZEzBenEMsdgsdfg48ItsowO9ZJ1jmBbo",
                "Header": {
                    "ccAddresses": [],
                    "fromAddress": [
                        "xxxx@xxx.com"
                    ],
                    "headerFrom": "\"xxxx@xxx.com\" <xxxx@xxx.com>",
                    "headerReplyTo": null,
                    "replyToAddress": [],
                    "toAddresses": [
                        "xxxx@xxx.com"
                    ],
                    "xmailer": null
                },
                "cluster": "hosted",
                "completelyRewritten": false,
                "id": "867899c4-bbde-9948-f0a2-740c13aafb98",
                "impostorScore": 0,
                "malwareScore": 0,
                "messageID": "<xxxx@xxx.com>",
                "messageParts": [
                    {
                        "contentType": "text/html",
                        "disposition": "inline",
                        "filename": "text.html",
                        "md5": "a",
                        "oContentType": "text/html",
                        "sandboxStatus": null,
                        "sha256": "99843dc18542ba1417b0b464c00f"
                    }
                ],
                "messageSize": 3684,
                "messageTime": "2021-06-07T01:50:00.000Z",
                "modulesRun": [
                    "av",
                    "spf",
                    "dkimv",
                    "spam",
                    "dmarc",
                    "pdr",
                    "urldefense"
                ],
                "phishScore": 100,
                "policyRoutes": [
                    "default_inbound"
                ],
                "quarantineFolder": "Phish",
                "quarantineRule": "inbound_spam_phish",
                "recipient": [
                    "xxxx@xxx.com"
                ],
                "sender": "xxxx@xxx.com",
                "senderIP": "000.000.000.000",
                "spamScore": 100,
                "subject": "Your mailbox is full......",
                "threatsInfoMap": [
                    {
                        "campaignID": null,
                        "classification": "phish",
                        "threat": "login/verify",
                        "threatID": "9a",
                        "threatStatus": "active",
                        "threatTime": "2021-06-07T00:47:12.000Z",
                        "threatType": "url",
                        "threatUrl": "https://threatinsight.proofpoint.com"
                    },
                ]
            }
        ]
    }
}

Human Readable Output

Blocked Messages

Sender IP Sender Recipient Subject Message Size Message Time Malware Score Phish Score Spam Score
000.000.000.000 xxxx@xxx.com xxxx@xxx.com Your mailbox is full…… 3684 2021-06-07T01:50:00.000Z 0 100 100

Blocked Messages Threats Information

Sender Recipient Subject Classification Threat Threat Status Threat Url Threat ID Threat Time Campaign ID
xxxx@xxx.com xxxx@xxx.com Your mailbox is full…… phish login/verify active https://threatinsight.proofpoint.com 9a53601a616eb78609e525c0f3ee5a3cfca 2021-06-07T00:47:12.000Z  

proofpoint-get-events-messages-delivered

Get events for delivered messages in the specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-get-events-messages-delivered

Input

Argument Name Description Required
threat_type Message’s threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: ‘url’, ‘attachment’, and ‘message’. Possible values are: url, attachment, message. Optional
threat_status Message’s threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: ‘active’, ‘cleared’, and ‘falsePositive’. Possible values are: active, cleared, falsePositive. Optional
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.MessagesDelivered.spamScore Number The spam score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.phishScore Number The phish score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.threatsInfoMap List List that contains details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.
Proofpoint.MessagesDelivered.messageTime Date The time the message was delivered to the user or quarantined by PPS.
Proofpoint.MessagesDelivered.impostorScore Number The impostor score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.malwareScore Number The malware score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.cluster String The name of the PPS cluster that processed the message.
Proofpoint.MessagesDelivered.subject String The subject line of the message, if available.
Proofpoint.MessagesDelivered.quarantineFolder String The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be ‘None’.
Proofpoint.MessagesDelivered.quarantineRule String The name of the rule that quarantined the message. This appears only for messagesBlocked events.
Proofpoint.MessagesDelivered.policyRoutes List The policy routes that the message matched during processing by PPS.
Proofpoint.MessagesDelivered.modulesRun String The list of PPS modules that processed the message.
Proofpoint.MessagesDelivered.messageSize Number The size in bytes of the message, including headers and attachments.
Proofpoint.MessagesDelivered.Header.headerFrom String The full content of the From header, including any friendly name.
Proofpoint.MessagesDelivered.Header.headerReplyTo String If present, the full content of the Reply-To: header, including any friendly names.
Proofpoint.MessagesDelivered.Header.fromAddress List The email address contained in the From header, excluding the friendly name.
Proofpoint.MessagesDelivered.Header.ccAddresses List A list of email addresses contained within the CC: header, excluding friendly names.
Proofpoint.MessagesDelivered.Header.replyToAddress List The email address contained in the Reply-To: header, excluding friendly name.
Proofpoint.MessagesDelivered.Header.toAddresses List A list of email addresses contained within the To: header, excluding friendly names.
Proofpoint.MessagesDelivered.Header.xmailer String The content of the X-Mailer: header, if present.
Proofpoint.MessagesDelivered.messageParts List An array of structures that contains details about parts of the message, including both message bodies and attachments.
Proofpoint.MessagesDelivered.completelyRewritten String The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is ‘na’, the message did not contain any URL-based threats.
Proofpoint.MessagesDelivered.id String The unique ID of the message.
Proofpoint.MessagesDelivered.sender String The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.MessagesDelivered.recipient List A list containing the email addresses of the recipients.
Proofpoint.MessagesDelivered.senderIP String The IP address of the sender.
Proofpoint.MessagesDelivered.messageID String Message-ID extracted from the headers of the email message.
Proofpoint.MessagesDelivered.GUID String The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.

Command Example

!proofpoint-get-events-messages-delivered interval="2021-06-03T17:00:00Z/2021-06-03T18:00:00Z"

Context Example

{
    "Proofpoint": {
        "MessagesDelivered": {
            "GUID": "Ggfsdfsdf",
            "Header": {
                "ccAddresses": [],
                "fromAddress": [
                    "xxxx@xxx.com"
                ],
                "headerFrom": "\"j.\" <xxxx@xxx.com>",
                "headerReplyTo": null,
                "replyToAddress": [],
                "toAddresses": [],
                "xmailer": null
            },
            "cluster": "hosted",
            "completelyRewritten": true,
            "id": "1828003vsdv05566e842",
            "impostorScore": 0,
            "malwareScore": 0,
            "messageID": "<SI2PR0dfbvd.xxxx@xxx.com.com>",
            "messageParts": [
                {
                    "contentType": "text/html",
                    "disposition": "inline",
                    "filename": "text.html",
                    "md5": "fcfa9b21f43fbdf02965263c63e",
                    "oContentType": "text/html",
                    "sandboxStatus": null,
                    "sha256": "72d3dc7a01dfbdbe8e871536864f56bf235ba08ff259105ac"
                },
            ],
            "messageSize": 10171,
            "messageTime": "2021-06-02T13:41:32.000Z",
            "modulesRun": [
                "av",
                "spf",
                "dkimv",
                "spam",
                "dmarc",
                "urldefense"
            ],
            "phishScore": 0,
            "policyRoutes": [
                "default_inbound",
                "allow_relay"
            ],
            "quarantineFolder": null,
            "quarantineRule": null,
            "recipient": [
                "xxxx@xxx.com"
            ],
            "sender": "xxxx@xxx.com",
            "senderIP": "400.000.000",
            "spamScore": 43,
            "subject": "=",
            "threatsInfoMap": [
                {
                    "campaignID": null,
                    "classification": "phish",
                    "threat": "https://bit.ly",
                    "threatID": "45fe3b35ghkk2b8916934b6c0a536cc9b2603d03",
                    "threatStatus": "active",
                    "threatTime": "2021-06-03T07:17:11.000Z",
                    "threatType": "url",
                    "threatUrl": "https://threatinsight.proofpoint.com"
                }
            ]
        }
    }
}

Human Readable Output

Delivered Messages

Sender IP Sender Recipient Subject Message Size Message Time Malware Score Phish Score Spam Score
00.000.000.0000 xxxx@xxx.com xxxx@xxx.com = 10171 2021-06-02T13:41:32.000Z 0 0 43

Delivered Messages Threats Information

Sender Recipient Subject Classification Threat Threat Status Threat Url Threat ID Threat Time Campaign ID
xxxx@xxx.com xxxx@xxx.com = phish https://bit.ly active https://threatinsight.proofpoint.com 45fe3b35b7bd2adfad6dea4d305bea3e7c1a2b8gfhh03d03 2021-06-03T07:17:11.000Z  

proofpoint-list-issues

Get events for clicks to malicious URLs permitted and messages delivered containing a known attachment threat within the specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-list-issues

Input

Argument Name Description Required
threat_type Event’s threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: ‘url’, ‘attachment’, and ‘message’. Possible values are: url, attachment, message. Optional
threat_status Event’s threat status to be retrieved.If no value is specified, active and cleared threats will be retrieved. Possible values: ‘url’, ‘attachment’, and ‘message’. Possible values are: active, cleared, falsePositive. Optional
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.ClicksPermitted.url String The malicious URL was clicked.
Proofpoint.ClicksPermitted.classification String The threat category of the malicious URL (Malware, Phish, or Spam).
Proofpoint.ClicksPermitted.clickTime Date The time the user clicked the URL.
Proofpoint.ClicksPermitted.threatTime Date The time that Proofpoint identified the URL as a threat.
Proofpoint.ClicksPermitted.userAgent String The User-Agent header from the clicker’s HTTP request.
Proofpoint.ClicksPermitted.campaignId String An identifier for the campaign of which the threat is a member.
Proofpoint.ClicksPermitted.id String The unique ID of the click.
Proofpoint.ClicksPermitted.clickIP String The external IP address of the user who clicked the link.
Proofpoint.ClicksPermitted.sender String The email address of the sender. The user-part is hashed. The domain-part is in cleartext.
Proofpoint.ClicksPermitted.recipient String The email address of the recipient.
Proofpoint.ClicksPermitted.senderIP String The IP address of the sender.
Proofpoint.ClicksPermitted.threatID String The unique identifier associated with this threat.
Proofpoint.ClicksPermitted.threatURL String A link to the entry on the TAP dashboard for the particular threat.
Proofpoint.ClicksPermitted.threatStatus String The current state of the threat.
Proofpoint.ClicksPermitted.messageID String The ID of the message that the URL belongs to.
Proofpoint.ClicksPermitted.GUID String The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
Proofpoint.MessagesDelivered.spamScore Number The spam score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.phishScore Number The phish score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.threatsInfoMap List List which contain details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.
Proofpoint.MessagesDelivered.messageTime Date THe time the message was delivered to the user or quarantined by PPS.
Proofpoint.MessagesDelivered.impostorScore Number The impostor score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.malwareScore Number The malware score of the message. Higher scores indicate higher certainty.
Proofpoint.MessagesDelivered.cluster String The name of the PPS cluster that processed the message.
Proofpoint.MessagesDelivered.subject String The subject line of the message, if available.
Proofpoint.MessagesDelivered.quarantineFolder String The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be ‘None’.
Proofpoint.MessagesDelivered.quarantineRule String The name of the rule that quarantined the message. This appears only for messagesBlocked events.
Proofpoint.MessagesDelivered.policyRoutes List The policy routes that the message matched during processing by PPS.
Proofpoint.MessagesDelivered.modulesRun String The list of PPS modules that processed the message.
Proofpoint.MessagesDelivered.messageSize Number The size in bytes of the message, including headers and attachments.
Proofpoint.MessagesDelivered.Header.headerFrom String The full content of the From header, including any friendly name.
Proofpoint.MessagesDelivered.Header.headerReplyTo String If present, the full content of the Reply-To: header, including any friendly names.
Proofpoint.MessagesDelivered.Header.fromAddress List The email address contained in the From header, excluding any friendly name.
Proofpoint.MessagesDelivered.Header.ccAddresses List A list of email addresses contained within the CC: header, excluding any friendly names.
Proofpoint.MessagesDelivered.Header.replyToAddress List The email address contained in the Reply-To: header, excluding any friendly name.
Proofpoint.MessagesDelivered.Header.toAddresses List A list of email addresses contained within the To: header, excluding any friendly names.
Proofpoint.MessagesDelivered.Header.xmailer String The content of the X-Mailer: header, if present.
Proofpoint.MessagesDelivered.messageParts List An array of structures that contain details about parts of the message, including both message bodies and attachments.
Proofpoint.MessagesDelivered.completelyRewritten String The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is ‘na’, the message did not contain any URL-based threats.
Proofpoint.MessagesDelivered.id String The unique ID of the message.
Proofpoint.MessagesDelivered.sender String The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
Proofpoint.MessagesDelivered.recipient List A list containing the email addresses of the recipients
Proofpoint.MessagesDelivered.senderIP String The IP address of the sender.
Proofpoint.MessagesDelivered.messageID String Message-ID extracted from the headers of the email message.
Proofpoint.MessagesDelivered.GUID String The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.

Command Example

!proofpoint-list-issues interval="2021-06-03T17:00:00Z/2021-06-03T18:00:00Z"

Context Example

{
    "Proofpoint": {
        "MessagesDelivered": {
            "GUID": "Ggfsdfsdf",
            "Header": {
                "ccAddresses": [],
                "fromAddress": [
                    "xxxx@xxx.com"
                ],
                "headerFrom": "\"j.\" <xxxx@xxx.com>",
                "headerReplyTo": null,
                "replyToAddress": [],
                "toAddresses": [],
                "xmailer": null
            },
            "cluster": "hosted",
            "completelyRewritten": true,
            "id": "1828003vsdv05566e842",
            "impostorScore": 0,
            "malwareScore": 0,
            "messageID": "<SI2PR0dfbvd.xxxx@xxx.com.com>",
            "messageParts": [
                {
                    "contentType": "text/html",
                    "disposition": "inline",
                    "filename": "text.html",
                    "md5": "fcfa9b21f43fbdf02965263c63e",
                    "oContentType": "text/html",
                    "sandboxStatus": null,
                    "sha256": "72d3dc7a01dfbdbe8e871536864f56bf235ba08ff259105ac"
                },
            ],
            "messageSize": 10171,
            "messageTime": "2021-06-02T13:41:32.000Z",
            "modulesRun": [
                "av",
                "spf",
                "dkimv",
                "spam",
                "dmarc",
                "urldefense"
            ],
            "phishScore": 0,
            "policyRoutes": [
                "default_inbound",
                "allow_relay"
            ],
            "quarantineFolder": null,
            "quarantineRule": null,
            "recipient": [
                "xxxx@xxx.com"
            ],
            "sender": "xxxx@xxx.com",
            "senderIP": "400.000.000",
            "spamScore": 43,
            "subject": "=",
            "threatsInfoMap": [
                {
                    "campaignID": null,
                    "classification": "phish",
                    "threat": "https://bit.ly",
                    "threatID": "45fe3b35ghkk2b8916934b6c0a536cc9b2603d03",
                    "threatStatus": "active",
                    "threatTime": "2021-06-03T07:17:11.000Z",
                    "threatType": "url",
                    "threatUrl": "https://threatinsight.proofpoint.com"
                }
            ]
        }
    }
}

Human Readable Output

Delivered Messages

Sender IP Sender Recipient Subject Message Size Message Time Malware Score Phish Score Spam Score
00.000.000.0000 xxxx@xxx.com xxxx@xxx.com = 10171 2021-06-02T13:41:32.000Z 0 0 43

Delivered Messages Threats Information

Sender Recipient Subject Classification Threat Threat Status Threat Url Threat ID Threat Time Campaign ID
xxxx@xxx.com xxxx@xxx.com = phish https://bit.ly active https://threatinsight.proofpoint.com 45fe3b35b7bd2adfad6dea4d305bea3e7c1a2b8gfhh03d03 2021-06-03T07:17:11.000Z  

Permitted click from list-issues command result

No entries.

proofpoint-list-campaigns

Gets a list of IDs of campaigns active in a specified time period. Must provide either the interval or time_range arguments.

Base Command

proofpoint-list-campaigns

Input

Argument Name Description Required
interval ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one day. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z. Optional
limit The maximum number of campaign IDs to produce in the response. Defaults to 100 and the maximum supported value is 200. Default is 100. Optional
page The page of results to return, in multiples of the specified size. Default is 1. Optional
time_range Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week. Optional

Context Output

Path Type Description
Proofpoint.Campaigns.id String The campaign ID.
Proofpoint.Campaigns.lastUpdatedAt String Last updated timestamp of the campaign.

Command Example

!proofpoint-list-campaigns interval="2021-06-01T11:00:00Z/2021-06-02T11:00:00Z"

Context Example

{
    "Proofpoint": {
        "Campaign": {
            "id": "7c91b71fdgdfgdfg591a1ad38",
            "lastUpdatedAt": "2021-06-03T13:01:57.000Z"
        }
    }
}

Human Readable Output

Campaigns List

Id Last Updated At
7c91b71fdgdfgdfg591a1ad38 2021-06-03T13:01:57.000Z

proofpoint-get-campaign

Gets details for a given campaign.

Base Command

proofpoint-get-campaign

Input

Argument Name Description Required
campaign_id ID of the required campaign. Required

Context Output

Path Type Description
Proofpoint.Campaign.info List The campaign information - ID,name, description, startDate, and notable.
Proofpoint.Campaign.actors List A list of actor objects.
Proofpoint.Campaign.families List A list of family objects.
Proofpoint.Campaign.malware List A list of malware objects.
Proofpoint.Campaign.techniques List A list of technique objects.
Proofpoint.Campaign.brands List A list of brand objects.
Proofpoint.Campaign.campaignMembers List A list of campaign member objects.

Command Example

!proofpoint-get-campaign campaign_id="f3ff0874-85ef-475e-b3fe-d05f97b2ed3f"

Context Example

{
    "Proofpoint": {
        "Campaign": {
            "actors": [],
            "brands": [],
            "campaignMembers": [],
            "families": [
                {
                    "id": "69a63403-f478-40f6-a4cb-3d2ffb85b98e",
                    "name": "Keylogger"
                }
            ],
            "info": {
                "description": "Messages purporting to be e.g.\r\n\r\n* from &lt;xxxx@xxx.com;' and subject \"Re: New Order From customer\".\r\n\r\nThese messages contain compressed executables that lead to the installation of AgentTesla with the following example configuration:\r\n\r\n<pre>C2_Email_Address: xxxx@xxx.com\r\nC2_Email_Password: \r\nC2_Email_Server: xxxx@xxx.com</pre>",
                "id": "f3ff087dfgdfge-d05f97b2ed3f",
                "name": "AgentTesla | Compressed Executables | \"techie\" | 25 March 2021",
                "notable": false,
                "startDate": "2021-03-25T00:00:00.000Z"
            },
            "malware": [
                {
                    "id": "4b50dfbdfb-901a-1cb4cf8a21fb",
                    "name": "AgentTesla"
                }
            ],
            "techniques": [
                {
                    "id": "e488ddfbdfb20-a1aa-d1a85494067c",
                    "name": "Compressed Executable"
                }
            ]
        }
    }
}

Human Readable Output

Campaign Information

Id Name Description Start Date Notable
f3ff08dfbdb5e-b3fe-d05f97b2ed3f AgentTesla | Compressed Executables | “techie” | 25 March 2021 Messages purporting to be e.g.

* from <xxxx@xxx.com>’ and subject “Re: New Order From customer”.

These messages contain compressed executables that lead to the installation of AgentTesla with the following example configuration:

<pre>C2_Email_Address: xxxx@xxx.com
C2_Email_Password:
C2_Email_Server: xxxx@xxx.com</pre>		 2021-03-25T00:00:00.000Z false

Campaign Members

No entries.

Families

Id Name
69a63403-dbfdfb4cb-3d2ffb85b98e Keylogger

Techniques

Id Name
e48835be-xcvxcvaa-d1a85494067c Compressed Executable

Actors

No entries.

Brands

No entries.

Malware

Id Name
4b500558-23d0-sfdsdf1cb4cf8a21fb AgentTesla

proofpoint-list-most-attacked-users

Gets a list of the most attacked users in the organization.

Base Command

proofpoint-list-most-attacked-users

Input

Argument Name Description Required
window An integer indicating how many days the data should be retrieved for. Possible values: “14”, “30”, “90”. Possible values are: 14, 30, 90. Default is false. Required
limit The maximum number of users to produce in the response. Default is 1000. Optional
page The page of results to return. Default is 1. Optional

Context Output

Path Type Description
Proofpoint.Vap.users List List of users in the organization.
Proofpoint.Vap.totalVapUsers Number The total number of VAP users for the interval.
Proofpoint.Vap.interval String An ISO8601-formatted interval showing the time the response was calculated for.
Proofpoint.Vap.averageAttackIndex Number The average attack index value for users during the interval.
Proofpoint.Vap.vapAttackIndexThreshold Number This interval’s attack index threshold, past which a user is considered a VAP.

Command Example

!proofpoint-list-most-attacked-users window="14"

Context Example

{
    "Proofpoint": {
        "Vap": {
            "averageAttackIndex": 307.05145,
            "interval": "2021-05-23T21:44:53Z/2021-06-06T21:44:53Z",
            "totalVapUsers": 1,
            "users": [
                {
                    "identity": {
                        "customerUserId": null,
                        "department": null,
                        "emails": [
                            "xxxx@xxx.com"
                        ],
                        "guid": "3b5132sdvsd76-c442-919e69175bdd",
                        "location": null,
                        "name": null,
                        "title": null,
                        "vip": false
                    },
                    "threatStatistics": {
                        "attackIndex": 4576,
                        "families": [
                            {
                                "name": "credential phishing",
                                "score": 7008
                            }
                        ]
                    }
                }
            ],
            "vapAttackIndexThreshold": 965.9637
        }
    }
}

Human Readable Output

Most Attacked Users Information

Total Vap Users Interval Average Attack Index Vap Attack Index Threshold
7 2021-05-23T21:44:53Z/2021-06-06T21:44:53Z 307.05145 965.9637

Threat Families

Mailbox Threat Family Name Threat Score
xxxx@xxx.com credential phishing 7008

proofpoint-get-top-clickers

Gets a list of the top clickers in the organization for a specified time period.

Base Command

proofpoint-get-top-clickers

Input

Argument Name Description Required
window An integer indicating how many days the data should be retrieved for. Possible values: “14”, “30”, “90”. Possible values are: 14, 30, 90. Default is false. Required
limit The maximum number of top clickers to produce in the response.The max supported value is 200. Default is 100. Optional
page The page of results to return. Default is 1. Optional

Context Output

Path Type Description
Proofpoint.Topclickers.users List List of users in the organization.
Proofpoint.Topclickers.totalTopClickers int The total number of top clickers in the time interval.
Proofpoint.Topclickers.interval Date An ISO8601-formatted interval showing the time the response was calculated for.

Command Example

!proofpoint-get-top-clickers window="90"

Context Example

{
    "Proofpoint": {
        "Topclickers": {
            "interval": "2021-03-09T07:17:00Z/2021-06-07T07:17:00Z",
            "totalTopClickers": 1,
            "users": [
                {
                    "clickStatistics": {
                        "clickCount": 2,
                        "families": [
                            {
                                "clicks": 2,
                                "name": "Malware"
                            }
                        ]
                    },
                    "identity": {
                        "customerUserId": null,
                        "department": null,
                        "emails": [
                            "xxxx@xxx.come"
                        ],
                        "guid": "44fa5svfdgae-f22f-b49b49b1e4e3",
                        "location": null,
                        "name": null,
                        "title": null,
                        "vip": false
                    }
                }
            ]
        }
    }
}

Human Readable Output

Top Clickers Users Information

Total Top Clickers Interval
1 2021-03-09T07:17:00Z/2021-06-07T07:17:00Z

Threat Families

Mailbox Threat Family Name Threat Score
xxxx@xxx.com Malware  

proofpoint-url-decode

Decodes URLs that have been rewritten by TAP to their original, target URL.

Base Command

proofpoint-url-decode

Input

Argument Name Description Required
urls A comma-separated list of encoded URLs. Required

Context Output

Path Type Description
Proofpoint.URL.encodedUrl String The original, rewritten URL supplied to the endpoint.
Proofpoint.URL.decodedUrl String The target URL embedded inside the rewritten link.
Proofpoint.URL.success Boolean Indicates whether the URL could successfully be decoded.

Command Example

!proofpoint-url-decode urls="https://urldefense.proofpoint.com/v2/url?u=http-3A__links.mkt3337.com_ctt-3Fkn-3D3-26ms-3DMzQ3OTg3MDQS1-26r-3DMzkxNzk3NDkwMDA0S0-26b-3D0-26j-3DMTMwMjA1ODYzNQS2-26mt-3D1-26rt-3D0&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=MujLDFBJstxoxZI_GKbsW7wxGM7nnIK__qZvVy6j9Wc&m=QJGhloAyfD0UZ6n8r6y9dF-khNKqvRAIWDRU_K65xPI&s=ew-rOtBFjiX1Hgv71XQJ5BEgl9TPaoWRm_Xp9Nuo8bk&e="

Context Example

{
    "Proofpoint": {
        "URL": {
            "decodedUrl": "http://links.mkt3337.com/ctt?kn=3&ms=MzQ3OTg3MDQS1&r=MzkxNzk3NDkwMDA0S0&b=0&j=MTMwMjA1ODYzNQS2&mt=1&rt=0",
            "encodedUrl": "https://urldefense.proofpoint.com/v2/url?u=http-3A__links.mkt3337.com_ctt-3Fkn-3D3-26ms-3DMzQ3OTg3MDQS1-26r-3DMzkxNzk3NDkwMDA0S0-26b-3D0-26j-3DMTMwMjA1ODYzNQS2-26mt-3D1-26rt-3D0&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=MujLDFBJstxoxZI_GKbsW7wxGM7nnIK__qZvVy6j9Wc&m=QJGhloAyfD0UZ6n8r6y9dF-khNKqvRAIWDRU_K65xPI&s=ew-rOtBFjiX1Hgv71XQJ5BEgl9TPaoWRm_Xp9Nuo8bk&e=",
            "success": true
        }
    }
}

Human Readable Output

URLs decoded information

Encoded Url Decoded Url
https://urldefense.proofpoint.com/v2/url?u=http-3A__links.mkt3337.com_ctt-3Fkn-3D3-26ms-3DMzQ3OTg3MDQS1-26r-3DMzkxNzk3NDkwMDA0S0-26b-3D0-26j-3DMTMwMjA1ODYzNQS2-26mt-3D1-26rt-3D0&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=MujLDFBJstxoxZI_GKbsW7wxGM7nnIK__qZvVy6j9Wc&m=QJGhloAyfD0UZ6n8r6y9dF-khNKqvRAIWDRU_K65xPI&s=ew-rOtBFjiX1Hgv71XQJ5BEgl9TPaoWRm_Xp9Nuo8bk&e= http://links.mkt3337.com/ctt?kn=3&ms=MzQ3OTg3MDQS1&r=MzkxNzk3NDkwMDA0S0&b=0&j=MTMwMjA1ODYzNQS2&mt=1&rt=0

Configuration parameters

  • url — Server URL (required)
  • credentials — Service Principal (required)
  • api_version — API Version
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • threat_type — Threat type
  • threat_status — Threat status
  • events_type — Events to fetch
  • limit — Maximum number of incident per fetch
  • fetch_time — First fetch time range
  • raw_json_encoding — Advanced: Raw message encoding
  • look_back_minutes — Events Fetch Look-Back (minutes)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (12)

  • proofpoint-get-campaign

    Gets details for a given campaign.

  • proofpoint-get-events

    Fetches events for all clicks and messages relating to known threats within the specified time period. Details as per clicks/blocked.

  • proofpoint-get-events-clicks-blocked

    Gets events for clicks to malicious URLs blocked in the specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-get-events-clicks-permitted

    Get events for clicks to malicious URLs permitted in the specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-get-events-messages-blocked

    Get events for blocked messages in the specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-get-events-messages-delivered

    Get events for delivered messages in the specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-get-forensics

    Returns forensics evidence.

  • proofpoint-get-top-clickers

    Gets a list of the top clickers in the organization for a specified time period.

  • proofpoint-list-campaigns

    Gets a list of IDs of campaigns active in a specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-list-issues

    Get events for clicks to malicious URLs permitted and messages delivered containing a known attachment threat within the specified time period. Must provide either the interval or time_range arguments.

  • proofpoint-list-most-attacked-users

    Gets a list of the most attacked users in the organization.

  • proofpoint-url-decode

    Decodes URLs that have been rewritten by TAP to their original, target URL.

Source

ProofpointTAP_v2.py ProofpointTAP_v2_test.py ProofpointTAP_v2.yml ProofpointTAP_v2_description.md
Download History Raw 
category: Email
provider: Thoma Bravo
sectionorder:
- Connect
- Collect
commonfields:
  id: Proofpoint TAP v2
  version: -1
configuration:
- additionalinfo: e.g., https://tap-api-v2.proofpoint.com
  defaultvalue: https://tap-api-v2.proofpoint.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The password refers to secret
  display: Service Principal
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: v1 is deprecated for new instances. The current API version is v2.
  defaultvalue: v2
  display: API Version
  name: api_version
  options:
  - v1
  - v2
  type: 15
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: A string specifying which threat type to return. If empty, all threat types are returned. Can be "url", "attachment", or "messageText".
  display: Threat type
  name: threat_type
  options:
  - url
  - attachment
  - messageText
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: A string specifying which threat statuses to return. If empty, will return "active" and "cleared" threats. Can be "active", "cleared", or "falsePositive".
  display: Threat status
  name: threat_status
  options:
  - active
  - cleared
  - falsePositive
  type: 16
  section: Collect
  advanced: true
  required: false
- defaultvalue: All
  display: Events to fetch
  name: events_type
  options:
  - All
  - Issues
  - Blocked Clicks
  - Permitted Clicks
  - Blocked Messages
  - Delivered Messages
  type: 15
  section: Collect
  advanced: true
  required: false
- defaultvalue: '50'
  display: Maximum number of incident per fetch
  name: limit
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Proofpoint supports a maximum 1 week fetch back.
  defaultvalue: 1 hour
  display: First fetch time range
  name: fetch_time
  type: 0
  section: Collect
  required: false
- additionalinfo: 'The character encoding to apply on the message fetched (e.g. latin-1). Advanced configuration to be used only if instructed by XSOAR Support'
  display: 'Advanced: Raw message encoding'
  name: raw_json_encoding
  type: 0
  section: Collect
  required: false
- additionalinfo: 'The number of minutes to look back during each fetch to handle the Proofpoint SIEM API indexing delay (up to 30 minutes). When set, each fetch cycle requeries the previous N minutes to catch late-indexing events that would otherwise be missed. Duplicates are filtered automatically. Set to 0 to disable.'
  defaultvalue: '30'
  display: Events Fetch Look-Back (minutes)
  name: look_back_minutes
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: Use the Proofpoint Targeted Attack Protection (TAP) integration to protect against and provide additional visibility into phishing and other malicious email attacks.
display: Proofpoint TAP v2
name: Proofpoint TAP v2
script:
  commands:
  - arguments:
    - description: 'A string containing an ISO8601-formatted interval. If this interval overlaps with previous requests for data, records from the previous request might be duplicated. The minimum interval is thirty seconds. The maximum interval is one hour. Examples: * 2016-05-01T12:00:00Z/2016-05-01T13:00:00Z - an hour interval, beginning at noon UTC on 05-01-2016 * PT30M/2016-05-01T12:30:00Z - the thirty minutes beginning at noon UTC on 05-01-2016 and ending at 12:30pm * UTC 2016-05-01T05:00:00-0700/PT30M - the same interval as above, but using -0700 as the time zone.'
      name: interval
    - auto: PREDEFINED
      description: 'A comma-separated list of the threat types to return. If empty, all threat types are returned. The following values are accepted: "url", "attachment", and "messageText".'
      name: threatType
      predefined:
      - url
      - attachment
      - messageText
    - auto: PREDEFINED
      description: A string specifying which threat statuses to return. If empty, active and cleared threats are returned. Can be "active", "cleared", "falsePositive".
      name: threatStatus
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'A string containing an ISO8601 date. It represents the start of the data retrieval period. The end of the period is determined by the current API server time rounded to the nearest minute. If JSON output is selected, the end time is included in the returned result. Example: 2016-05-01T12:00:00Z.'
      name: sinceTime
    - description: An integer representing a time window (in seconds) from the current API server time. The start of the window is the current API server time, rounded to the nearest minute, less the number of seconds provided. The end of the window is the current API server time rounded to the nearest minute. If JSON output is selected, the end time is included in the returned result.
      name: sinceSeconds
    - auto: PREDEFINED
      defaultValue: All
      description: 'Event types to return. Possible values: "All", "Issues", "Delivered Messages", "Blocked Messages", "Permitted Clicks", and "Blocked Clicks".'
      name: eventTypes
      predefined:
      - All
      - Issues
      - Delivered Messages
      - Blocked Messages
      - Permitted Clicks
      - Blocked Clicks
    description: Fetches events for all clicks and messages relating to known threats within the specified time period. Details as per clicks/blocked.
    name: proofpoint-get-events
    outputs:
    - contextPath: Proofpoint.MessagesDelivered.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.QID
      description: The queue ID of the message within PPS. It can be used to identify the message in PPS, which is not unique.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.ccAddresses
      description: 'A list of email addresses contained within the CC: header, excluding any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.clusterId
      description: The name of the PPS cluster which processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.fromAddress
      description: 'The email address contained in the From: header, excluding any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.headerCC
      description: The CC header.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.headerFrom
      description: 'The full content of the From: header, including any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.headerReplyTo
      description: 'If present, the full content of the Reply-To: header, including any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.impostorScore
      description: The impostor score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.malwareScore
      description: The malware score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.messageId
      description: Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS, which is not unique.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threat
      description: The artifact which was condemned by Proofpoint. The malicious URL, hash of the attachment threat, or email address of the impostor sender.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threatId
      description: The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threatStatus
      description: The current state of the threat (active, expired, false-positive, cleared).
      type: String
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threatTime
      description: The time Proofpoint assigned the threatStatus (ISO8601 format).
      type: Date
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threatType
      description: Whether the threat was an attachment, URL, or message type.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap.threatUrl
      description: A link to the entry about the threat on the TAP Dashboard.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageTime
      description: The time the message was delivered to the user or quarantined by PPS.
      type: Date
    - contextPath: Proofpoint.MessagesDelivered.modulesRun
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.phishScore
      description: The phishing score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.policyRoutes
      description: The policy routes that the message matched during processing by PPS.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineFolder
      description: The name of the folder that contains the quarantined message. This appears only for messagesBlocked.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineRule
      description: The name of the rule that quarantined the message. This appears only for messagesBlocked events.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.recipient
      description: A list containing the email addresses of the recipients.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.replyToAddress
      description: 'The email address contained in the Reply-To: header, excluding any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.sender
      description: The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.spamScore
      description: The spam score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.subject
      description: The subject line of the message, if available.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.QID
      description: The queue ID of the message within PPS. It can be used to identify the message in PPS, which is not unique.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.ccAddresses
      description: 'A list of email addresses contained within the CC: header, excluding any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.clusterId
      description: The name of the PPS cluster that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.fromAddress
      description: 'The email address contained in the From: header, excluding any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.headerCC
      description: The CC header.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.headerFrom
      description: 'The full content of the From: header, including any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.headerReplyTo
      description: 'If present, the full content of the Reply-To: header, including any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.impostorScore
      description: The impostor score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.malwareScore
      description: The malware score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.messageId
      description: Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS, which is not unique.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threat
      description: The artifact which was condemned by Proofpoint. The malicious URL, hash of the attachment threat, or email address of the impostor sender.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threatId
      description: The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threatStatus
      description: The current state of the threat (active, expired, false-positive, cleared).
      type: String
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threatTime
      description: The time Proofpoint assigned the threatStatus (ISO8601 format).
      type: Date
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threatType
      description: Whether the threat was an attachment, URL, or message type.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap.threatUrl
      description: A link to the entry about the threat on the TAP dashboard.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.messageTime
      description: The time the message was blocked to the user or quarantined by PPS.
      type: Date
    - contextPath: Proofpoint.MessagesBlocked.messageTime
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.modulesRun
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.phishScore
      description: The phishing score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.policyRoutes
      description: The policy routes that the message matched during processing by PPS.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.quarantineFolder
      description: The name of the folder that contains the quarantined message. This appears only for messagesBlocked.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.quarantineRule
      description: The name of the rule that quarantined the message. This appears only for messagesBlocked events.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.recipient
      description: A list containing the email addresses of the recipients.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.replyToAddress
      description: 'The email address contained in the Reply-To: header, excluding any friendly name.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.sender
      description: The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.spamScore
      description: The spam score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.subject
      description: The subject line of the message, if available.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS, which is unique.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.campaignId
      description: An identifier for the campaign of which the threat is a member, if available at the time of the query. Threats can be linked to campaigns even after these events are retrieved.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.classification
      description: The threat category of the malicious URL.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickIP
      description: The external IP address of the user who clicked the link. If the user is behind a firewall performing network address translation, the IP address of the firewall will be shown.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickTime
      description: The time the user clicked the URL.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.messageID
      description: The Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS and is not unique.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.recipient
      description: The email address of the recipient.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.sender
      description: The email address of the sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatID
      description: 'The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.'
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatTime
      description: The time Proofpoint identified the URL as a threat.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.threatURL
      description: A link to the entry on the TAP Dashboard for the particular threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.url
      description: The malicious URL which was clicked.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.userAgent
      description: The User-Agent header from the clicker's HTTP request.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.campaignId
      description: An identifier for the campaign of which the threat is a member, if available at the time of the query. Threats can be linked to campaigns even after these events are retrieved.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.classification
      description: The threat category of the malicious URL.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.clickIP
      description: The external IP address of the user who clicked the link. If the user is behind a firewall performing network address translation, the IP address of the firewall will be shown.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.clickTime
      description: The time the user clicked the URL.
      type: Date
    - contextPath: Proofpoint.ClicksBlocked.messageID
      description: Message-ID extracted from the headers of the email message. It can be used to look up the associated message in PPS and is not unique.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.recipient
      description: The email address of the recipient.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.sender
      description: The email address of the sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.threatID
      description: 'The unique identifier associated with this threat. It can be used to query the forensics and campaign endpoints.'
      type: String
    - contextPath: Proofpoint.ClicksBlocked.threatTime
      description: The time Proofpoint identified the URL as a threat.
      type: Date
    - contextPath: Proofpoint.ClicksBlocked.threatURL
      description: A link to the entry on the TAP dashboard for the particular threat.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.url
      description: The malicious URL that was clicked.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.userAgent
      description: The User-Agent header from the clicker's HTTP request.
      type: String
  - arguments:
    - description: The ID of the threat (use with either threatId or campaignId).
      name: threatId
    - description: ID of the campaign (use with either threatId or campaignId).
      name: campaignId
    - defaultValue: 'false'
      description: Whether to include forensic evidence for the whole campaign. Can be used with threatId only.
      name: includeCampaignForensics
    description: Returns forensics evidence.
    name: proofpoint-get-forensics
    outputs:
    - contextPath: Proofpoint.Report.ID
      description: The ID of the report.
      type: String
    - contextPath: Proofpoint.Report.Type
      description: 'The threat type. Can be: "attachment", "url", or "hybrid".'
      type: String
    - contextPath: Proofpoint.Report.Scope
      description: Whether the report scope covers a campaign or an individual threat.
      type: String
    - contextPath: Proofpoint.Report.Attachment.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Attachment.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Attachment.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Attachment.SHA256
      description: The SHA256 hash of the attachment's contents.
      type: String
    - contextPath: Proofpoint.Report.Attachment.MD5
      description: The MD5 hash of the attachment's contents.
      type: String
    - contextPath: Proofpoint.Report.Attachment.Blacklisted
      description: Optional. Whether the file was block listed.
      type: Number
    - contextPath: Proofpoint.Report.Attachment.Offset
      description: Optional. The offset in bytes where the malicious content was found.
      type: Number
    - contextPath: Proofpoint.Report.Attachment.Size
      description: Optional. The size in bytes of the attachment's contents.
      type: Number
    - contextPath: Proofpoint.Report.Attachment.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Attachment.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Attachment.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Cookie.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Action
      description: Whether the cookie was set or deleted.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Domain
      description: The domain that set the cookie.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Key
      description: The name of the cookie being set or deleted.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Value
      description: Optional. The content of the cookie being set.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Platform.Name
      description: Name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Cookie.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.DNS.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.DNS.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.DNS.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.DNS.Host
      description: The hostname being resolved.
      type: String
    - contextPath: Proofpoint.Report.DNS.CNames
      description: Optional. An array of CNames, which were associated with the hostname.
      type: String
    - contextPath: Proofpoint.Report.DNS.IP
      description: Optional. An array of IP addresses that were resolved to the hostname.
      type: String
    - contextPath: Proofpoint.Report.DNS.NameServers
      description: Optional. The nameservers responsible for the hostname's domain.
      type: String
    - contextPath: Proofpoint.Report.DNS.NameServersList
      description: Optional. The nameservers responsible for the hostnames.
      type: String
    - contextPath: Proofpoint.Report.DNS.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.DNS.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.DNS.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Dropper.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Path
      description: The location of the dropper file.
      type: String
    - contextPath: Proofpoint.Report.Dropper.URL
      description: Optional. The name of the static rule inside the sandbox that identified the dropper.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Rule
      description: Optional. The URL the dropper contacted.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Dropper.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.File.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.File.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.File.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.File.Path
      description: Optional. The location of the file operated on.
      type: String
    - contextPath: Proofpoint.Report.File.Action
      description: Optional. The filesystem call made (create, modify, or delete).
      type: String
    - contextPath: Proofpoint.Report.File.Rule
      description: Optional. The name of the static rule inside the sandbox that identified the suspicious file.
      type: String
    - contextPath: Proofpoint.Report.File.SHA256
      description: Optional. The SH256 hash of the file's contents.
      type: Unknown
    - contextPath: Proofpoint.Report.File.MD5
      description: Optional. The MD5 hash of the file's contents.
      type: String
    - contextPath: Proofpoint.Report.File.Size
      description: Optional. The size in bytes of the file's contents.
      type: Number
    - contextPath: Proofpoint.Report.File.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.File.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.File.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.IDS.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.IDS.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.IDS.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.IDS.Name
      description: The friendly name of the IDS rule that observed the malicious traffic.
      type: String
    - contextPath: Proofpoint.Report.IDS.SignatureID
      description: The identifier of the IDS rule that observed the malicious traffic.
      type: String
    - contextPath: Proofpoint.Report.IDS.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.IDS.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.IDS.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Mutex.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Name
      description: The name of the mutex.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Path
      description: Optional. The path to the process which spawned the mutex.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Mutex.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Network.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Network.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Network.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Network.Action
      description: The type of network activity being initiated (connect or listen).
      type: String
    - contextPath: Proofpoint.Report.Network.IP
      description: The remote IP address being contacted.
      type: String
    - contextPath: Proofpoint.Report.Network.Port
      description: The remote IP port being contacted.
      type: String
    - contextPath: Proofpoint.Report.Network.Type
      description: The protocol being used (tcp or udp).
      type: String
    - contextPath: Proofpoint.Report.Network.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Network.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Network.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Process.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Process.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Process.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Process.Action
      description: The action performed on the process. Relevant when create is produced.
      type: String
    - contextPath: Proofpoint.Report.Process.Path
      description: The location of the executable that spawned the process.
      type: String
    - contextPath: Proofpoint.Report.Process.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Process.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Process.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Registry.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Registry.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Registry.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Registry.Name
      description: Optional. The name of the registry entry being created or set.
      type: String
    - contextPath: Proofpoint.Report.Registry.Action
      description: The registry change made (create or set).
      type: String
    - contextPath: Proofpoint.Report.Registry.Key
      description: The location of the registry key being modified.
      type: String
    - contextPath: Proofpoint.Report.Registry.Value
      description: Optional. The contents of the key being created or set.
      type: String
    - contextPath: Proofpoint.Report.Registry.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Registry.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Registry.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.URL.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.URL.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.URL.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.URL.URL
      description: The URL which was observed.
      type: String
    - contextPath: Proofpoint.Report.URL.Blacklisted
      description: Optional. Whether the URL appeared on a block list.
      type: Boolean
    - contextPath: Proofpoint.Report.URL.SHA256
      description: Optional. The SHA256 hash of the file downloaded from the URL.
      type: String
    - contextPath: Proofpoint.Report.URL.MD5
      description: Optional. The MD5 hash of the file downloaded from the URL.
      type: String
    - contextPath: Proofpoint.Report.URL.Size
      description: Optional. The size in bytes of the file retrieved from the URL.
      type: Number
    - contextPath: Proofpoint.Report.URL.HTTPStatus
      description: Optional. The HTTP status code that was produced when our sandbox visited the URL.
      type: Number
    - contextPath: Proofpoint.Report.URL.IP
      description: Optional. The IP address that was resolved to the hostname by the sandbox.
      type: String
    - contextPath: Proofpoint.Report.URL.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.URL.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.URL.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Behavior.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Behavior.URL
      description: The URL that was observed.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Path
      description: The location of the executable which spawned the behavior.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Behavior.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Behavior.URL
      description: The URL that was observed.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Path
      description: The location of the executable that spawned the behavior.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.Name
      description: The name of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.OS
      description: The operating system of the platform.
      type: String
    - contextPath: Proofpoint.Report.Behavior.Platform.Version
      description: The version of the platform.
      type: String
    - contextPath: Proofpoint.Report.Screenshot.Time
      description: The relative time at which the evidence was observed during sandboxing.
      type: Date
    - contextPath: Proofpoint.Report.Screenshot.Malicious
      description: Whether the evidence was used to reach a malicious verdict.
      type: String
    - contextPath: Proofpoint.Report.Screenshot.Display
      description: A friendly display string.
      type: String
    - contextPath: Proofpoint.Report.Screenshot.URL
      description: The URL hosting the screenshot image.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Click's threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: 'active', 'cleared', and 'falsePositive'."
      name: threat_status
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Gets events for clicks to malicious URLs blocked in the specified time period. Must provide either the interval or time_range arguments.
    name: proofpoint-get-events-clicks-blocked
    outputs:
    - contextPath: Proofpoint.ClicksBlocked.url
      description: The malicious URL was clicked.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.classification
      description: The threat category of the malicious URL (Malware, Phish, or Spam).
      type: String
    - contextPath: Proofpoint.ClicksBlocked.clickTime
      description: The time the user clicked the URL.
      type: Date
    - contextPath: Proofpoint.ClicksBlocked.threatTime
      description: The time that Proofpoint identified the URL as a threat.
      type: Date
    - contextPath: Proofpoint.ClicksBlocked.userAgent
      description: The User-Agent header from the clicker's HTTP request.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.campaignId
      description: An identifier for the campaign of which the threat is a member.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.id
      description: The unique ID of the click.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.clickIP
      description: The external IP address of the user who clicked the link.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.sender
      description: The email address of the sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.recipient
      description: The email address of the recipient.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.threatID
      description: 'The unique identifier associated with this threat.'
      type: String
    - contextPath: Proofpoint.ClicksBlocked.threatURL
      description: A link to the entry on the TAP dashboard for the particular threat.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.threatStatus
      description: The current state of the threat.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.messageID
      description: The ID of the message that the URL belongs to.
      type: String
    - contextPath: Proofpoint.ClicksBlocked.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Click's threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: 'active', 'cleared', and 'falsePositive'."
      name: threat_status
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Get events for clicks to malicious URLs permitted in the specified time period.  Must provide either the interval or time_range arguments.
    name: proofpoint-get-events-clicks-permitted
    outputs:
    - contextPath: Proofpoint.ClicksPermitted.url
      description: The malicious URL that was clicked.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.classification
      description: The threat category of the malicious URL (Malware, Phish, or Spam).
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickTime
      description: The time the user clicked the URL.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.threatTime
      description: The time that Proofpoint identified the URL as a threat.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.userAgent
      description: The User-Agent header from the clicker's HTTP request.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.campaignId
      description: An identifier for the campaign of which the threat is a member.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.id
      description: The unique ID of the click.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickIP
      description: The external IP address of the user who clicked the link.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.sender
      description: The email address of the sender. The user-part is hashed. The domain-part is in cleartext.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.recipient
      description: The email address of the recipient.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatID
      description: The unique identifier associated with this threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatURL
      description: A link to the entry on the TAP dashboard for the particular threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatStatus
      description: The current state of the threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.messageID
      description: The ID of the message that the URL belongs to.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Message's threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: 'url', 'attachment', and 'message'."
      name: threat_type
      predefined:
      - url
      - attachment
      - message
    - auto: PREDEFINED
      description: "Message's threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: 'active', 'cleared', and 'falsePositive'."
      name: threat_status
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Get events for blocked messages in the specified time period. Must provide either the interval or time_range arguments.
    name: proofpoint-get-events-messages-blocked
    outputs:
    - contextPath: Proofpoint.MessagesBlocked.spamScore
      description: The spam score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.phishScore
      description: The phish score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.threatsInfoMap
      description: 'List that contains details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.'
      type: List
    - contextPath: Proofpoint.MessagesBlocked.messageTime
      description: The time the message was delivered to the user or quarantined by PPS.
      type: Date
    - contextPath: Proofpoint.MessagesBlocked.impostorScore
      description: The impostor score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.malwareScore
      description: The malware score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.cluster
      description: The name of the PPS cluster that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.subject
      description: The subject line of the message, if available.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.quarantineFolder
      description: The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be 'None'.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.quarantineRule
      description: The name of the rule that quarantined the message. This appears only for messagesBlocked events.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.policyRoutes
      description: The policy routes that the message matched during processing by PPS.
      type: List
    - contextPath: Proofpoint.MessagesBlocked.modulesRun
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.messageSize
      description: The size in bytes of the message, including headers and attachments.
      type: Number
    - contextPath: Proofpoint.MessagesBlocked.Header.headerFrom
      description: The full content of the From header, including any friendly name.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.Header.headerReplyTo
      description: 'If present, the full content of the Reply-To: header, including any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.Header.fromAddress
      description: The email address contained in the From header, excluding the friendly name.
      type: List
    - contextPath: Proofpoint.MessagesBlocked.Header.ccAddresses
      description: 'A list of email addresses contained within the CC: header, excluding friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesBlocked.Header.replyToAddress
      description: 'The email address contained in the Reply-To: header, excluding friendly name.'
      type: List
    - contextPath: Proofpoint.MessagesBlocked.Header.toAddresses
      description: 'A list of email addresses contained within the To: header, excluding friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesBlocked.Header.xmailer
      description: 'The content of the X-Mailer: header, if present.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.messageParts
      description: An array of structures that contain details about parts of the message, including both message bodies and attachments.
      type: List
    - contextPath: Proofpoint.MessagesBlocked.completelyRewritten
      description: The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is 'na', the message did not contain any URL-based threats.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.id
      description: The unique ID of the message.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.sender
      description: The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.recipient
      description: A list containing the email addresses of the recipients.
      type: List
    - contextPath: Proofpoint.MessagesBlocked.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.MessagesBlocked.messageID
      description: 'Message-ID extracted from the headers of the email message.'
      type: String
    - contextPath: Proofpoint.MessagesBlocked.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Message's threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: 'url', 'attachment', and 'message'."
      name: threat_type
      predefined:
      - url
      - attachment
      - message
    - auto: PREDEFINED
      description: "Message's threat status to be retrieved. If no value is specified, active and cleared threats will be retrieved. Possible values: 'active', 'cleared', and 'falsePositive'."
      name: threat_status
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Get events for delivered messages in the specified time period. Must provide either the interval or time_range arguments.
    name: proofpoint-get-events-messages-delivered
    outputs:
    - contextPath: Proofpoint.MessagesDelivered.spamScore
      description: The spam score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.phishScore
      description: The phish score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap
      description: 'List that contains details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.messageTime
      description: The time the message was delivered to the user or quarantined by PPS.
      type: Date
    - contextPath: Proofpoint.MessagesDelivered.impostorScore
      description: The impostor score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.malwareScore
      description: The malware score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.cluster
      description: The name of the PPS cluster that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.subject
      description: The subject line of the message, if available.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineFolder
      description: The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be 'None'.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineRule
      description: The name of the rule that quarantined the message. This appears only for messagesBlocked events.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.policyRoutes
      description: The policy routes that the message matched during processing by PPS.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.modulesRun
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageSize
      description: The size in bytes of the message, including headers and attachments.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.Header.headerFrom
      description: The full content of the From header, including any friendly name.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.Header.headerReplyTo
      description: 'If present, the full content of the Reply-To: header, including any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.Header.fromAddress
      description: The email address contained in the From header, excluding the friendly name.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.ccAddresses
      description: 'A list of email addresses contained within the CC: header, excluding friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.replyToAddress
      description: 'The email address contained in the Reply-To: header, excluding friendly name.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.toAddresses
      description: 'A list of email addresses contained within the To: header, excluding friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.xmailer
      description: 'The content of the X-Mailer: header, if present.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageParts
      description: An array of structures that contains details about parts of the message, including both message bodies and attachments.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.completelyRewritten
      description: The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is 'na', the message did not contain any URL-based threats.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.id
      description: The unique ID of the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.sender
      description: The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.recipient
      description: A list containing the email addresses of the recipients.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageID
      description: 'Message-ID extracted from the headers of the email message.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Event's threat type to be retrieved. If no value is specified, all threat types will be retrieved. Possible values: 'url', 'attachment', and 'message'."
      name: threat_type
      predefined:
      - url
      - attachment
      - message
    - auto: PREDEFINED
      description: "Event's threat status to be retrieved.If no value is specified, active and cleared threats will be retrieved. Possible values: 'url', 'attachment', and 'message'."
      name: threat_status
      predefined:
      - active
      - cleared
      - falsePositive
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one hour. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Get events for clicks to malicious URLs permitted and messages delivered containing a known attachment threat within the specified time period. Must provide either the interval or time_range arguments.
    name: proofpoint-list-issues
    outputs:
    - contextPath: Proofpoint.ClicksPermitted.url
      description: The malicious URL was clicked.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.classification
      description: The threat category of the malicious URL (Malware, Phish, or Spam).
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickTime
      description: The time the user clicked the URL.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.threatTime
      description: The time that Proofpoint identified the URL as a threat.
      type: Date
    - contextPath: Proofpoint.ClicksPermitted.userAgent
      description: The User-Agent header from the clicker's HTTP request.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.campaignId
      description: An identifier for the campaign of which the threat is a member.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.id
      description: The unique ID of the click.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.clickIP
      description: The external IP address of the user who clicked the link.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.sender
      description: The email address of the sender. The user-part is hashed. The domain-part is in cleartext.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.recipient
      description: The email address of the recipient.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatID
      description: The unique identifier associated with this threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatURL
      description: A link to the entry on the TAP dashboard for the particular threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.threatStatus
      description: The current state of the threat.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.messageID
      description: The ID of the message that the URL belongs to.
      type: String
    - contextPath: Proofpoint.ClicksPermitted.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.spamScore
      description: The spam score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.phishScore
      description: The phish score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.threatsInfoMap
      description: 'List which contain details about detected threats within the message. Contains: campaignID, classification, threat, threatID, threatStatus,threatTime, threatType, threatUrl.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.messageTime
      description: THe time the message was delivered to the user or quarantined by PPS.
      type: Date
    - contextPath: Proofpoint.MessagesDelivered.impostorScore
      description: The impostor score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.malwareScore
      description: The malware score of the message. Higher scores indicate higher certainty.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.cluster
      description: The name of the PPS cluster that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.subject
      description: The subject line of the message, if available.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineFolder
      description: The name of the folder that contains the quarantined message. This appears only for blocked messages. For delivered messages will be 'None'.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.quarantineRule
      description: The name of the rule that quarantined the message. This appears only for messagesBlocked events.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.policyRoutes
      description: The policy routes that the message matched during processing by PPS.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.modulesRun
      description: The list of PPS modules that processed the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageSize
      description: The size in bytes of the message, including headers and attachments.
      type: Number
    - contextPath: Proofpoint.MessagesDelivered.Header.headerFrom
      description: The full content of the From header, including any friendly name.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.Header.headerReplyTo
      description: 'If present, the full content of the Reply-To: header, including any friendly names.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.Header.fromAddress
      description: The email address contained in the From header, excluding any friendly name.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.ccAddresses
      description: 'A list of email addresses contained within the CC: header, excluding any friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.replyToAddress
      description: 'The email address contained in the Reply-To: header, excluding any friendly name.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.toAddresses
      description: 'A list of email addresses contained within the To: header, excluding any friendly names.'
      type: List
    - contextPath: Proofpoint.MessagesDelivered.Header.xmailer
      description: 'The content of the X-Mailer: header, if present.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageParts
      description: An array of structures that contain details about parts of the message, including both message bodies and attachments.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.completelyRewritten
      description: The rewrite status of the message. If value is true, all instances of URL threats within the message were successfully rewritten. If the value is false, at least one instance of the threat URL was not rewritten. If the value is 'na', the message did not contain any URL-based threats.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.id
      description: The unique ID of the message.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.sender
      description: The email address of the SMTP (envelope) sender. The user-part is hashed. The domain-part is cleartext.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.recipient
      description: A list containing the email addresses of the recipients.
      type: List
    - contextPath: Proofpoint.MessagesDelivered.senderIP
      description: The IP address of the sender.
      type: String
    - contextPath: Proofpoint.MessagesDelivered.messageID
      description: 'Message-ID extracted from the headers of the email message.'
      type: String
    - contextPath: Proofpoint.MessagesDelivered.GUID
      description: The ID of the message within PPS. It can be used to identify the message in PPS and is guaranteed to be unique.
      type: String
  - arguments:
    - description: 'ISO8601-formatted interval date. The minimum interval is thirty seconds. The maximum interval is one day. For example: 2021-04-27T09:00:00Z/2021-04-27T10:00:00Z.'
      name: interval
    - defaultValue: '100'
      description: The maximum number of campaign IDs to produce in the response. Defaults to 100 and the maximum supported value is 200.
      name: limit
    - defaultValue: '1'
      description: The page of results to return, in multiples of the specified size.
      name: page
    - description: 'Represents the start of the data retrieval period. For example: 1 week, 2 days, 3 hours, etc. The maximum is 1 week.'
      name: time_range
    description: Gets a list of IDs of campaigns active in a specified time period. Must provide either the interval or time_range arguments.
    name: proofpoint-list-campaigns
    outputs:
    - contextPath: Proofpoint.Campaigns.id
      description: The campaign ID.
      type: String
    - contextPath: Proofpoint.Campaigns.lastUpdatedAt
      description: Last updated timestamp of the campaign.
      type: String
  - arguments:
    - description: ID of the required campaign.
      name: campaign_id
      required: true
    description: Gets details for a given campaign.
    name: proofpoint-get-campaign
    outputs:
    - contextPath: Proofpoint.Campaign.info
      description: The campaign information - ID,name, description, startDate, and notable.
      type: List
    - contextPath: Proofpoint.Campaign.actors
      description: A list of actor objects.
      type: List
    - contextPath: Proofpoint.Campaign.families
      description: A list of family objects.
      type: List
    - contextPath: Proofpoint.Campaign.malware
      description: A list of malware objects.
      type: List
    - contextPath: Proofpoint.Campaign.techniques
      description: A list of technique objects.
      type: List
    - contextPath: Proofpoint.Campaign.brands
      description: A list of brand objects.
      type: List
    - contextPath: Proofpoint.Campaign.campaignMembers
      description: A list of campaign member objects.
      type: List
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'An integer indicating how many days the data should be retrieved for. Possible values: "14", "30", "90".'
      name: window
      predefined:
      - '14'
      - '30'
      - '90'
      required: true
    - defaultValue: '1000'
      description: The maximum number of users to produce in the response.
      name: limit
    - defaultValue: '1'
      description: The page of results to return.
      name: page
    description: Gets a list of the most attacked users in the organization.
    name: proofpoint-list-most-attacked-users
    outputs:
    - contextPath: Proofpoint.Vap.users
      description: List of users in the organization.
      type: List
    - contextPath: Proofpoint.Vap.totalVapUsers
      description: The total number of VAP users for the interval.
      type: Number
    - contextPath: Proofpoint.Vap.interval
      description: An ISO8601-formatted interval showing the time the response was calculated for.
      type: String
    - contextPath: Proofpoint.Vap.averageAttackIndex
      description: The average attack index value for users during the interval.
      type: Number
    - contextPath: Proofpoint.Vap.vapAttackIndexThreshold
      description: This interval's attack index threshold, past which a user is considered a VAP.
      type: Number
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'An integer indicating how many days the data should be retrieved for. Possible values: "14", "30", "90".'
      name: window
      predefined:
      - '14'
      - '30'
      - '90'
      required: true
    - defaultValue: '100'
      description: The maximum number of top clickers to produce in the response.The max supported value is 200.
      name: limit
    - defaultValue: '1'
      description: The page of results to return.
      name: page
    description: Gets a list of the top clickers in the organization for a specified time period.
    name: proofpoint-get-top-clickers
    outputs:
    - contextPath: Proofpoint.Topclickers.users
      description: List of users in the organization.
      type: List
    - contextPath: Proofpoint.Topclickers.totalTopClickers
      description: The total number of top clickers in the time interval.
      type: int
    - contextPath: Proofpoint.Topclickers.interval
      description: An ISO8601-formatted interval showing the time the response was calculated for.
      type: Date
  - arguments:
    - description: A comma-separated list of encoded URLs.
      name: urls
      required: true
    description: Decodes URLs that have been rewritten by TAP to their original, target URL.
    name: proofpoint-url-decode
    outputs:
    - contextPath: Proofpoint.URL.encodedUrl
      description: The original, rewritten URL supplied to the endpoint.
      type: String
    - contextPath: Proofpoint.URL.decodedUrl
      description: The target URL embedded inside the rewritten link.
      type: String
    - contextPath: Proofpoint.URL.success
      description: Indicates whether the URL could successfully be decoded.
      type: Boolean
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test - no instance
fromversion: 5.0.0