Skip to main content

​
Get BEC messages protected

Action ID: tools.proofpoint_threat_protection.get_bec_messages_protected Get BEC messages protected statistics. Calls GET /api/v1/dash/reports/bec-reports/messages-protected. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get BEC messages protected trend

Action ID: tools.proofpoint_threat_protection.get_bec_messages_protected_trend Get BEC messages protected trend data over time. Calls GET /api/v1/dash/reports/bec-reports/bec-messages-protected-trend. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Defaults to DAY.Default: null.

​
Get BEC themes trend

Action ID: tools.proofpoint_threat_protection.get_bec_themes_trend Get BEC themes trend data over time. Calls GET /api/v1/dash/reports/bec-reports/bec-themes-trend. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Time grouping. Valid values: DAY, WEEK, MONTH. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.Default: null.

​
Get effectiveness clicks protected

Action ID: tools.proofpoint_threat_protection.get_effectiveness_clicks_protected Get metrics about malicious clicks that were blocked or protected. Calls GET /api/v1/dash/reports/effectiveness-reports/clicks-protected. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Time grouping for results. Valid values: DAY, WEEK, MONTH. Defaults to WEEK.Default: null.

​
Get effectiveness custom blocklist activity

Action ID: tools.proofpoint_threat_protection.get_effectiveness_custom_blocklist_activity Get activity metrics for custom blocklists configured in the system. Calls GET /api/v1/dash/reports/effectiveness-reports/custom-blocklist-activity. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get effectiveness messages protected

Action ID: tools.proofpoint_threat_protection.get_effectiveness_messages_protected Get metrics about messages protected with optional breakdown by threat type or other dimensions. Calls GET /api/v1/dash/reports/effectiveness-reports/messages-protected. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.Default: null.

​
Get effectiveness messages protected trend

Action ID: tools.proofpoint_threat_protection.get_effectiveness_messages_protected_trend Get trend data for messages protected over time with various filtering and grouping options. Calls GET /api/v1/dash/reports/effectiveness-reports/messages-protected-trend. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.Default: null.
​
string | null
Message category filter (when breakdown=by-threat-category). Valid values: MALWARE, PHISHING, SPAM, BEC, TOAD.Default: null.
​
string | null
Time grouping for results. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on data range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.Default: null.
​
string | null
Message type filter (when breakdown=by-threat-type). Valid values: ALL, URL, ATTACHMENT, MESSAGE, HYBRID.Default: null.

​
Get effectiveness threat response quarantines

Action ID: tools.proofpoint_threat_protection.get_effectiveness_threat_response_quarantines Get metrics about messages quarantined by Threat Response actions. Calls GET /api/v1/dash/reports/effectiveness-reports/threat-response-quarantines. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Time grouping for results. Valid values: DAY, WEEK, MONTH. Defaults to WEEK.Default: null.

​
Get effectiveness URL rewritten summary

Action ID: tools.proofpoint_threat_protection.get_effectiveness_url_rewritten_summary Get summary metrics for URLs that have been rewritten by URL Defense. Calls GET /api/v1/dash/reports/effectiveness-reports/url-rewritten-summary. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get executive summary advanced threat detection messages protected

Action ID: tools.proofpoint_threat_protection.get_executive_summary_advanced_threat_detection_messages_protected Get detailed metrics about messages protected by advanced threat detection, with breakdowns by threat type or other dimensions. Calls GET /api/v1/dash/reports/executive-summary/advanced-threat-detection-messages-protected. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.Default: null.
​
string | null
Message category filter (when breakdown=by-threat-category). Valid values: MALWARE, PHISHING, SPAM, BEC, TOAD.Default: null.
​
string | null
Time grouping for results. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.Default: null.
​
string | null
Message type filter (when breakdown=by-threat-type). Valid values: ALL, URL, ATTACHMENT, MESSAGE, HYBRID.Default: null.

​
Get executive summary inbound email protection breakdown

Action ID: tools.proofpoint_threat_protection.get_executive_summary_inbound_email_protection_breakdown Get breakdown of inbound email protection metrics for the specified cluster and time range. This endpoint mirrors the Dashboard › Executive Summary › Inbound Email Protection Breakdown card. Calls GET /api/v1/dash/reports/executive-summary/inbound-email-protection-breakdown. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
Cluster ID for the request.
​
string
required
End time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-31T23:59:59.000Z).
​
string
required
Start time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-01T00:00:00.000Z).
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get executive summary inbound protection overview

Action ID: tools.proofpoint_threat_protection.get_executive_summary_inbound_protection_overview Get an overview of inbound protection metrics including messages processed, threats detected, and protection effectiveness. Calls GET /api/v1/dash/reports/executive-summary/inbound-protection-overview. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-31T23:59:59Z).
​
string
required
Start time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-01T00:00:00Z).
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get executive summary industry comparison

Action ID: tools.proofpoint_threat_protection.get_executive_summary_industry_comparison Get industry comparison metrics to compare your company’s data (quarterly) with up to 3 industries. Calls GET /api/v1/dash/reports/executive-summary/industry-comparison. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
Starting month for the comparison period in ISO 8601 format (e.g., 2026-01).
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
array[string] | null
List of industry verticals to compare against. Maximum 3 verticals allowed. Use key values from list_industries. Defaults to Customer’s default.Default: null.

​
Get executive summary threat categories

Action ID: tools.proofpoint_threat_protection.get_executive_summary_threat_categories Get a breakdown of threats by category for the specified time period. Calls GET /api/v1/dash/reports/executive-summary/threat-categories. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get executive summary threat landscape effectiveness

Action ID: tools.proofpoint_threat_protection.get_executive_summary_threat_landscape_effectiveness Get threat landscape and effectiveness metrics with various breakdown options. Calls GET /api/v1/dash/reports/executive-summary/threat-landscape-effectiveness. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Breakdown dimension. Valid values: actors, malware, families, techniques, threat-objectives. Defaults to threat-objectives.Default: null.
​
string | null
Number of results to return. Valid values: top5, top10. Defaults to top5.Default: null.
​
string | null
Message status filter. Valid values: volume, delivered, clicks. Defaults to volume.Default: null.

​
Get executive summary top clickers

Action ID: tools.proofpoint_threat_protection.get_executive_summary_top_clickers Get information about users who have clicked on the most malicious links (Top Clickers). Calls GET /api/v1/dash/reports/executive-summary/top-clickers. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get executive summary very attacked people

Action ID: tools.proofpoint_threat_protection.get_executive_summary_very_attacked_people Get information about the most targeted individuals in the organization (Very Attacked People). Calls GET /api/v1/dash/reports/executive-summary/very-attacked-people. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
Action ID: tools.proofpoint_threat_protection.get_organization_historical_attack_index_trending Get historical attack index trend data with comparison against selected benchmarks. Calls GET /api/v1/dash/reports/organization-reports/historical-attack-index-trending. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
Time interval for trending data. Valid values: 1Y, MAX.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
array[string] | null
List of comparison benchmarks (e.g., industry verticals, CUSTOMER_YEAR_OVER_YEAR). Maximum 4 options allowed. Valid vertical names or CUSTOMER_YEAR_OVER_YEAR. Note: CUSTOMER_YEAR_OVER_YEAR is only allowed when interval=1Y.Default: null.

​
Get organization industry comparison

Action ID: tools.proofpoint_threat_protection.get_organization_industry_comparison Compares organization’s threat metrics against selected industry verticals over a specified interval. Calls GET /api/v1/dash/reports/organization-reports/industry-comparison. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
Time interval for comparison. Valid values: MONTH, QUARTER.
​
string
required
Start month in YYYY-MM format. Must be valid YYYY-MM format within allowed range: from last 13 months to current month minus interval value (MONTH=1, QUARTER=3).
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
array[string] | null
List of industry verticals. Maximum 3 allowed. Valid industry names. Defaults to Customer’s default.Default: null.

​
Get people targeted by BEC threats

Action ID: tools.proofpoint_threat_protection.get_bec_targeted_people Get all people targeted by BEC threats. Calls GET /api/v1/dash/reports/bec-reports/people-targeted-by-bec-threats. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get people top 10 clickers

Action ID: tools.proofpoint_threat_protection.get_people_top_ten_clickers Get top 10 users who clicked on the most malicious URLs. Calls GET /api/v1/dash/reports/people-reports/top-ten-clickers. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get people top 10 isolated clickers

Action ID: tools.proofpoint_threat_protection.get_people_top_ten_isolated_clickers Get top 10 users who had the most clicks isolated by Browser Isolation. Calls GET /api/v1/dash/reports/people-reports/top-ten-isolated-clickers. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get people top 10 recipients

Action ID: tools.proofpoint_threat_protection.get_people_top_ten_recipients Get top 10 users who received the most threat messages. Calls GET /api/v1/dash/reports/people-reports/top-ten-recipients. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get people VIP activity

Action ID: tools.proofpoint_threat_protection.get_people_vip_activity Get VIP activity and threat statistics. Calls GET /api/v1/dash/reports/people-reports/vip-activity. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape overview headline

Action ID: tools.proofpoint_threat_protection.get_landscape_overview_headline Get headline statistics for the threat landscape overview. Calls GET /api/v1/dash/reports/landscape-reports/overview-headline. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape spread and targeting

Action ID: tools.proofpoint_threat_protection.get_landscape_spread_and_targeting Get spread and targeting metrics. Calls GET /api/v1/dash/reports/landscape-reports/spread-and-targeting. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape threat campaigns vs individual threats

Action ID: tools.proofpoint_threat_protection.get_landscape_threat_campaigns_vs_individual_threats Get comparison of threat campaigns versus individual threats. Calls GET /api/v1/dash/reports/landscape-reports/threat-campaigns-vs-individual-threats. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape threat categories

Action ID: tools.proofpoint_threat_protection.get_landscape_threat_categories Get threat category statistics for the threat landscape reports. Calls GET /api/v1/dash/reports/landscape-reports/threat-categories. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape threat types by message volume

Action ID: tools.proofpoint_threat_protection.get_landscape_threat_types_by_message_volume Get threat types aggregated by message volume. Calls GET /api/v1/dash/reports/landscape-reports/threat-types-by-message-volume. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape top 10 actors

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_actors Get top 10 threat actors for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-actors. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 campaigns

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_campaigns Get top 10 threat campaigns for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-campaigns. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 domains sending threats

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_domains_sending_threats Get top 10 domains sending threat messages. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-domains-sending-threats. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 families

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_families Get top 10 threat families for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-families. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 malware

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_malware Get top 10 malware threats for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-malware. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 root domains for URL attacks

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_root_domains_for_url_attacks Get top 10 root domains used in URL-based attacks. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-root-domains-for-url-attacks. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 subdomains for URL attacks

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_subdomains_for_url_attacks Get top 10 subdomains used in URL-based attacks. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-subdomains-for-url-attacks. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top 10 techniques

Action ID: tools.proofpoint_threat_protection.get_landscape_top_ten_techniques Get top 10 attack techniques for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-techniques. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.Default: null.

​
Get threat landscape top BEC themes

Action ID: tools.proofpoint_threat_protection.get_landscape_top_bec_themes Get top BEC themes for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-bec-themes. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape top threat objectives

Action ID: tools.proofpoint_threat_protection.get_landscape_top_threat_objectives Get top threat objectives across the specified time range. Calls GET /api/v1/dash/reports/landscape-reports/top-threat-objectives. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat landscape trend

Action ID: tools.proofpoint_threat_protection.get_landscape_trend Get threat landscape trend data with configurable grouping and breakdown. Calls GET /api/v1/dash/reports/landscape-reports/landscape-trend. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Breakdown dimension. Valid values: OBJECTIVES, FAMILIES, MALWARE, ACTORS, TECHNIQUES, THEME. Defaults to OBJECTIVES.Default: null.
​
string | null
Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to WEEK.Default: null.

​
Get threat landscape vertically targeted activity

Action ID: tools.proofpoint_threat_protection.get_landscape_vertically_targeted_activity Get vertically targeted threat activity. Calls GET /api/v1/dash/reports/landscape-reports/vertically-targeted-activity. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat objectives industry comparison

Action ID: tools.proofpoint_threat_protection.get_threat_objectives_industry_comparison Compares threat objectives against selected industry verticals. Calls GET /api/v1/dash/reports/threat-objectives-reports/industry-comparison. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
array[string] | null
List of industry verticals. Maximum 3 allowed. Valid industry names. Defaults to Customer’s default.Default: null.

​
Get threat objectives messages protected

Action ID: tools.proofpoint_threat_protection.get_threat_objectives_messages_protected Get messages protected statistics grouped by threat objectives. Calls GET /api/v1/dash/reports/threat-objectives-reports/messages-protected. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get threat objectives trend

Action ID: tools.proofpoint_threat_protection.get_threat_objectives_trend Get threat objectives trend data over time. Calls GET /api/v1/dash/reports/threat-objectives-reports/threat-objectives-trend. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
string | null
Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to WEEK.Default: null.

​
Get top BEC themes

Action ID: tools.proofpoint_threat_protection.get_bec_top_themes Get top BEC themes for the specified time range. Calls GET /api/v1/dash/reports/bec-reports/top-bec-themes. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get very attacked people summary

Action ID: tools.proofpoint_threat_protection.get_very_attacked_people_summary Get summary statistics for Very Attacked People (VAP). Calls GET /api/v1/dash/reports/people-reports/very-attacked-people/summary. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
Get VIPs targeted by BEC threats

Action ID: tools.proofpoint_threat_protection.get_bec_targeted_vips Get VIPs targeted by BEC threats. Calls GET /api/v1/dash/reports/bec-reports/vips-targeted-by-bec-threats. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
List actors

Action ID: tools.proofpoint_threat_protection.list_actors Get a paginated and sorted list of top threat actors for the specified time range. Calls GET /api/v1/dash/reports/actor-reports/actors. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time for the reporting period in ISO 8601 UTC format.
​
string
required
Start time for the reporting period in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
integer | null
Page number for pagination. Non-negative integer. Defaults to 0.Default: null.
​
integer | null
Number of results per page. Positive integer. Defaults to 10.Default: null.
​
string | null
Field to sort by. Valid values: ATTACK_INDEX, DISTINCT_THREATS. Defaults to ATTACK_INDEX.Default: null.
​
string | null
Sort order. Valid values: ASC, DESC. Defaults to DESC.Default: null.

​
List industries

Action ID: tools.proofpoint_threat_protection.list_industries Get a list of available industries/verticals for use in filtering and comparison operations. Calls GET /api/v1/dash/reports/industries. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.

​
List mail bomb events

Action ID: tools.proofpoint_threat_protection.list_mail_bomb_events List email bomb events detected for the organization in a time range with GET /api/v1/dash/reports/mail-bomb-events. The range can be at most 90 days and start at most 365 days ago. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Email_Bomb_Events_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End of the time range in ISO 8601 UTC format, e.g. 2024-01-31T23:59:59Z.
​
string
required
Start of the time range in ISO 8601 UTC format, e.g. 2024-01-01T00:00:00Z.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.
​
integer | null
Zero-based page number. Defaults to 0.Default: null.
​
integer | null
Number of events per page. Defaults to 100.Default: null.

​
List very attacked people

Action ID: tools.proofpoint_threat_protection.list_very_attacked_people Get the list of Very Attacked People (VAP) with detailed information. Calls GET /api/v1/dash/reports/people-reports/very-attacked-people/list. Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API

​
Secrets

Required secrets:
  • proofpoint_threat_protection_oauth: OAuth token PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN.

​
Input fields

​
string
required
End time in ISO 8601 UTC format.
​
string
required
Start time in ISO 8601 UTC format.
​
string | null
Proofpoint Threat Protection API base URL. Defaults to https://threatprotection-api.proofpoint.com.Default: null.