Skip to main content

​
Decode URLs

Action ID: tools.proofpoint_tap.decode_urls Decode URLs rewritten by Proofpoint URL Defense back to their original destinations with POST /v2/url/decode. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/URL_Decoder_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
array[string]
required
Rewritten URLs to decode.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.

​
Get campaign

Action ID: tools.proofpoint_tap.get_campaign Get details for a campaign, including its description, actors, malware families, techniques, and threat variants, with GET /v2/campaign/{campaignId}. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Campaign_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
string
required
Campaign ID.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.

​
Get forensics

Action ID: tools.proofpoint_tap.get_forensics Get forensic evidence (sandbox behaviors, network activity, dropped files, and IOCs) for a threat or campaign with GET /v2/forensics. Provide exactly one of threatId or campaignId. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Forensics_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.
​
string | null
Campaign ID to get forensics for. Provide exactly one of threatId or campaignId.Default: null.
​
boolean | null
Whether to include forensics for the campaign the threat belongs to. Only valid with threatId. Defaults to false.Default: null.
​
string | null
Threat ID to get forensics for. Provide exactly one of threatId or campaignId.Default: null.

​
Get threat summary

Action ID: tools.proofpoint_tap.get_threat_summary Get a summary of a threat, including its type, status, severity, classification, and associated campaigns and actors, with GET /v2/threat/summary/{threatId}. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Threat_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
string
required
Threat ID.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.

​
List campaign IDs

Action ID: tools.proofpoint_tap.list_campaign_ids List IDs of campaigns active in a time window with GET /v2/campaign/ids. The interval must be between 30 seconds and 1 day. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Campaign_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
string
required
ISO 8601 time interval to query, e.g. 2020-05-01T12:00:00Z/2020-05-01T13:00:00Z. Must span between 30 seconds and 1 day.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.
​
integer | null
Page of results to return, starting at 1. Defaults to 1.Default: null.
​
integer | null
Maximum number of campaign IDs per page. Defaults to 100; maximum 200.Default: null.

​
List top clickers

Action ID: tools.proofpoint_tap.list_top_clickers List the users who clicked the most malicious URLs over a time window with GET /v2/people/top-clickers. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/People_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
integer
required
Number of days to report on. Valid values: 14, 30, 90.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.
​
integer | null
Page of results to return, starting at 1. Defaults to 1.Default: null.
​
integer | null
Maximum number of people per page. Defaults to 100; maximum 200.Default: null.

​
List very attacked people

Action ID: tools.proofpoint_tap.list_very_attacked_people List Very Attacked People (VAPs) in the organization ranked by attack index over a time window with GET /v2/people/vap. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/People_API

​
Secrets

Required secrets:
  • proofpoint_tap: required values PROOFPOINT_TAP_SERVICE_PRINCIPAL, PROOFPOINT_TAP_SERVICE_SECRET.

​
Input fields

​
integer
required
Number of days to report on. Valid values: 14, 30, 90.
​
string | null
Proofpoint TAP API base URL. Defaults to https://tap-api-v2.proofpoint.com.Default: null.
​
integer | null
Page of results to return, starting at 1. Defaults to 1.Default: null.
​
integer | null
Maximum number of people per page. Defaults to 1000.Default: null.