Proofpoint

Get detailed information about a specific DLP incident, including matched rules, sensitive data types, and message metadata.

List messages that were encrypted by Proofpoint Email Encryption. Shows encrypted message status and recipient access.

List DLP incidents. Returns messages that triggered DLP rules, including policy violations and sensitive data detections.

Get detailed information about a specific detection event, including full threat analysis and message metadata.

Get detection event statistics. Returns counts of spam, phishing, malware, and impostor detections over a time period.

List spam, phishing, and malware detection events. Returns events where Proofpoint detected and acted on threats.

Get forensic evidence for all threats in a campaign. Returns aggregated behavioral analysis across all associated threats.

Get forensic evidence for a specific threat. Returns behavioral analysis, network activity, file modifications, and other forensic indicators.

Auto-pull (search & destroy) messages from mailboxes. This is a destructive operation that removes delivered messages from user mailboxes.

Search for messages across mailboxes for threat response. Used for search & destroy / auto-pull operations to find and remediate delivered threats.

Discover available Proofpoint tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Get top clickers report. Returns users who clicked on the most threat URLs, indicating users who may need additional security training.

Get the risk score and attack details for a specific user by email address.

Get the Very Attacked People (VAP) report. Returns users who received the most attacks, ranked by attack index. Useful for identifying high-risk users.

Get detailed information about a specific policy including rules, conditions, and actions.

List all email security policies. Returns policy names, types, and enabled status.

List email routing rules/routes. Shows how mail is routed based on policy configuration.

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently delete a quarantined message. This action cannot be undone and will remove the message from quarantine storage. Confirm with the user before invoking.

List quarantined messages. Returns messages held in quarantine with sender, recipient, subject, and reason.

⚠ HIGH-IMPACT. Release a quarantined message, delivering it to the intended recipient. Irreversible delivery but message itself is preserved. Can deliver malicious mail to user. Confirm with the user before invoking.

Search quarantine by keyword across sender, recipient, and subject fields.

Get executive summary report. High-level security posture overview suitable for management reporting. Includes threat trends, top targeted users, and effectiveness metrics.

Get mail flow report. Shows email volume over time with breakdown by disposition (delivered, blocked, quarantined).

Get organization security summary. Returns high-level metrics: total messages processed, threats blocked, quarantined, and delivered.

Get threat summary report. Breakdown of threats by type (spam, phishing, malware, impostor) with counts and trends.

Get the full email headers for a specific message.

Get detailed information about a specific message including headers, processing log, and delivery details.

Trace messages through the Proofpoint mail flow. Search by sender, recipient, subject, or message ID to track delivery status and processing history.

Show credentials status and available domains

Get all threats (messages and clicks) from the TAP SIEM API for a given time window. Returns both delivered/blocked messages and permitted/blocked clicks.

Get blocked clicks on threat URLs. These are clicks that were prevented from reaching the malicious destination.

Get permitted clicks on threat URLs. These are clicks that were allowed through to the destination.

Get messages blocked that contained threats. These are messages quarantined or rejected before reaching the recipient.

Get messages delivered containing threats. These are messages that reached the recipient's mailbox despite containing identified threats.

Get detailed information about a specific threat by its threat ID. Returns threat type, classification, and associated indicators.

Get details of a specific threat campaign by campaign ID. Returns campaign actors, malware families, techniques, and associated messages.

Get indicators of compromise (IOCs) for a specific campaign or time range. Returns URLs, IPs, domains, file hashes associated with threats.

List known threat families tracked by Proofpoint. Returns malware family names, descriptions, and associated campaigns.

Analyze a URL for threats. Returns threat classification, risk score, and associated campaigns.

Decode one or more Proofpoint URL Defense rewritten URLs back to the original URLs. Proofpoint rewrites URLs in emails for click-time protection; this tool reverses that encoding.