> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Proofpoint TAP

> Reference for the Tracecat Proofpoint TAP integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Decode URLs

Action ID: `tools.proofpoint_tap.decode_urls`

Decode URLs rewritten by Proofpoint URL Defense back to their original destinations with POST /v2/url/decode.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/URL\_Decoder\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/URL_Decoder_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="urls" type="array[string]" required>
  Rewritten URLs to decode.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

## Get campaign

Action ID: `tools.proofpoint_tap.get_campaign`

Get details for a campaign, including its description, actors, malware families, techniques, and threat variants, with GET /v2/campaign/\{campaignId}.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Campaign\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Campaign_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="campaignId" type="string" required>
  Campaign ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

## Get forensics

Action ID: `tools.proofpoint_tap.get_forensics`

Get forensic evidence (sandbox behaviors, network activity, dropped files, and IOCs) for a threat or campaign with GET /v2/forensics. Provide exactly one of threatId or campaignId.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Forensics\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Forensics_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="campaignId" type="string | null">
  Campaign ID to get forensics for. Provide exactly one of threatId or campaignId.

  Default: `null`.
</ParamField>

<ParamField path="includeCampaignForensics" type="boolean | null">
  Whether to include forensics for the campaign the threat belongs to. Only valid with threatId. Defaults to false.

  Default: `null`.
</ParamField>

<ParamField path="threatId" type="string | null">
  Threat ID to get forensics for. Provide exactly one of threatId or campaignId.

  Default: `null`.
</ParamField>

## Get threat summary

Action ID: `tools.proofpoint_tap.get_threat_summary`

Get a summary of a threat, including its type, status, severity, classification, and associated campaigns and actors, with GET /v2/threat/summary/\{threatId}.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Threat\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Threat_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="threatId" type="string" required>
  Threat ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

## List campaign IDs

Action ID: `tools.proofpoint_tap.list_campaign_ids`

List IDs of campaigns active in a time window with GET /v2/campaign/ids. The interval must be between 30 seconds and 1 day.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Campaign\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Campaign_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="interval" type="string" required>
  ISO 8601 time interval to query, e.g. 2020-05-01T12:00:00Z/2020-05-01T13:00:00Z. Must span between 30 seconds and 1 day.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page of results to return, starting at 1. Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Maximum number of campaign IDs per page. Defaults to 100; maximum 200.

  Default: `null`.
</ParamField>

## List top clickers

Action ID: `tools.proofpoint_tap.list_top_clickers`

List the users who clicked the most malicious URLs over a time window with GET /v2/people/top-clickers.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/People\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/People_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="window" type="integer" required>
  Number of days to report on. Valid values: 14, 30, 90.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page of results to return, starting at 1. Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Maximum number of people per page. Defaults to 100; maximum 200.

  Default: `null`.
</ParamField>

## List very attacked people

Action ID: `tools.proofpoint_tap.list_very_attacked_people`

List Very Attacked People (VAPs) in the organization ranked by attack index over a time window with GET /v2/people/vap.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/People\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/People_API)

### Secrets

Required secrets:

* `proofpoint_tap`: required values `PROOFPOINT_TAP_SERVICE_PRINCIPAL`, `PROOFPOINT_TAP_SERVICE_SECRET`.

### Input fields

<ParamField path="window" type="integer" required>
  Number of days to report on. Valid values: 14, 30, 90.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint TAP API base URL. Defaults to [https://tap-api-v2.proofpoint.com](https://tap-api-v2.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page of results to return, starting at 1. Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Maximum number of people per page. Defaults to 1000.

  Default: `null`.
</ParamField>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.