Proofpoint MCP

Reconstruct up to 7 days of SIEM threat events in one command. The SIEM API caps every request at a 1-hour window with a 7-day lookback; backfill chunks the requested range into compliant windows, fetches each single-type feed, and persists every event to the local SQLite store with stable IDs. Use this command to build or repair the local event store. Do NOT use it for a quick last-hour live check; use 'siem list-issues' instead.

Get campaign detail (actors, malware, techniques, members). Required: campaignId. Returns the CampaignDetail.

Heavily rate limited (50 requests per rolling 24 hours). Prefer the local synced store for repeated queries. Required: interval. Optional: size (default: 100), page (default: 1). Returns array of CampaignSummary.

Expand a campaign into the threats inside it using the unlimited campaign-detail endpoint, then enrich each threat with severity, category, and status from the local threat store when present. Repeated campaign questions never touch the 50-per-day campaign-ids quota.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

Provide exactly one of threatId or campaignId. threatId queries are limited to 50 per rolling 24 hours; campaignId queries to 1800. Optional: threatId, campaignId, includeCampaignForensics (default: false). Returns array of ForensicReport.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Compose a single incident brief from three sources: the threat summary endpoint (severity, actors, malware, techniques), the forensics endpoint (flattened indicator evidence), and locally synced events that touched the threatId. Use this command for a full single-incident brief from a threatId. Do NOT use this command to extract just the raw indicators for blocking; use 'iocs' instead.

Flatten TAP's nested forensic evidence tree into a flat indicator table: sha256, md5, url, domain, ip, file_path, registry_key, process_path, mutex. Output pipes straight into a blocklist import or EDR hunt. Use this command to extract only the raw indicators for blocking or hunting. Do NOT use this command for the full narrative incident brief; use 'incident' instead.

List users who clicked the most malicious links in a window. Optional: window (default: 30), size (default: 100), page (default: 1). Returns array of ClickerUser.

List Very Attacked People (highest attack index) for a window. Optional: window (default: 30), size (default: 1000), page (default: 1). Returns array of VapUser.

Intersect the Very Attacked People list with the top-clickers list for the same window. The result is the highest-risk set: people drawing heavy targeting who also click. No single TAP endpoint can answer this; the CLI joins the two People feeds on identity.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Fetch all click and message threat events in the window. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Fetch clicks to malicious URLs that were blocked in the window. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Fetch clicks to malicious URLs that were permitted in the window. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Events for clicks to malicious URLs permitted and messages delivered containing a known threat within the window — the subset that got through and needs response. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Fetch blocked messages that contained a known threat. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Fetch delivered messages that contained a known threat. Optional: sinceSeconds (default: 3600), interval, sinceTime (plus 3 more). Returns the SiemResponse.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Get a threat summary (severity, spread, actors, malware, techniques). Required: threatId. Returns the ThreatSummary.

Decode TAP-rewritten (urldefense) URLs to their original targets. Required: urls. Returns array of UrlDecodeResult. (public)

One view of a person across every source: locally synced click and message events (run 'backfill' or 'sync' first), plus live VAP and top-clicker status for the window. Use this during investigations to answer "show me every event touching this user" without re-spending SIEM quota. Use --data-source local to skip the live People lookups and read only the local store.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources