Proofpoint TAP Threat Intelligence

What problem does it solve?

This Skill helps security analysts and MSPs efficiently query and understand threat intelligence data from Proofpoint Targeted Attack Protection (TAP), enabling faster incident response and threat hunting.

Core Features & Use Cases

• Query Threat Data: Retrieve active URL threats, attachment threats, and message text threats.
• Analyze SIEM Events: Examine click events (permitted and blocked) and message delivery events for detailed threat context.
• Investigate Campaigns: Gather intelligence on threat campaigns, including actors, families, and associated infrastructure.
• Use Case: Investigate a user-reported suspicious email by querying SIEM events for related clicks and messages, then use campaign data to understand the broader attack.

Quick Start

Use the proofpoint threat skill to get all blocked click events in the last 24 hours.