> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Proofpoint Threat Protection

> Reference for the Tracecat Proofpoint Threat Protection integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get BEC messages protected

Action ID: `tools.proofpoint_threat_protection.get_bec_messages_protected`

Get BEC messages protected statistics. Calls GET /api/v1/dash/reports/bec-reports/messages-protected.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get BEC messages protected trend

Action ID: `tools.proofpoint_threat_protection.get_bec_messages_protected_trend`

Get BEC messages protected trend data over time. Calls GET /api/v1/dash/reports/bec-reports/bec-messages-protected-trend.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Defaults to DAY.

  Default: `null`.
</ParamField>

## Get BEC themes trend

Action ID: `tools.proofpoint_threat_protection.get_bec_themes_trend`

Get BEC themes trend data over time. Calls GET /api/v1/dash/reports/bec-reports/bec-themes-trend.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping. Valid values: DAY, WEEK, MONTH. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.

  Default: `null`.
</ParamField>

## Get effectiveness clicks protected

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_clicks_protected`

Get metrics about malicious clicks that were blocked or protected. Calls GET /api/v1/dash/reports/effectiveness-reports/clicks-protected.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping for results. Valid values: DAY, WEEK, MONTH. Defaults to WEEK.

  Default: `null`.
</ParamField>

## Get effectiveness custom blocklist activity

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_custom_blocklist_activity`

Get activity metrics for custom blocklists configured in the system. Calls GET /api/v1/dash/reports/effectiveness-reports/custom-blocklist-activity.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get effectiveness messages protected

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_messages_protected`

Get metrics about messages protected with optional breakdown by threat type or other dimensions. Calls GET /api/v1/dash/reports/effectiveness-reports/messages-protected.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="breakdown" type="string | null">
  Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.

  Default: `null`.
</ParamField>

## Get effectiveness messages protected trend

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_messages_protected_trend`

Get trend data for messages protected over time with various filtering and grouping options. Calls GET /api/v1/dash/reports/effectiveness-reports/messages-protected-trend.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="breakdown" type="string | null">
  Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.

  Default: `null`.
</ParamField>

<ParamField path="category" type="string | null">
  Message category filter (when breakdown=by-threat-category). Valid values: MALWARE, PHISHING, SPAM, BEC, TOAD.

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping for results. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on data range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  Message type filter (when breakdown=by-threat-type). Valid values: ALL, URL, ATTACHMENT, MESSAGE, HYBRID.

  Default: `null`.
</ParamField>

## Get effectiveness threat response quarantines

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_threat_response_quarantines`

Get metrics about messages quarantined by Threat Response actions. Calls GET /api/v1/dash/reports/effectiveness-reports/threat-response-quarantines.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping for results. Valid values: DAY, WEEK, MONTH. Defaults to WEEK.

  Default: `null`.
</ParamField>

## Get effectiveness URL rewritten summary

Action ID: `tools.proofpoint_threat_protection.get_effectiveness_url_rewritten_summary`

Get summary metrics for URLs that have been rewritten by URL Defense. Calls GET /api/v1/dash/reports/effectiveness-reports/url-rewritten-summary.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get executive summary advanced threat detection messages protected

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_advanced_threat_detection_messages_protected`

Get detailed metrics about messages protected by advanced threat detection, with breakdowns by threat type or other dimensions. Calls GET /api/v1/dash/reports/executive-summary/advanced-threat-detection-messages-protected.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="breakdown" type="string | null">
  Breakdown dimension for the data. Valid values: by-threat-type, by-threat-category. Defaults to by-threat-type.

  Default: `null`.
</ParamField>

<ParamField path="category" type="string | null">
  Message category filter (when breakdown=by-threat-category). Valid values: MALWARE, PHISHING, SPAM, BEC, TOAD.

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping for results. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to DAY.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  Message type filter (when breakdown=by-threat-type). Valid values: ALL, URL, ATTACHMENT, MESSAGE, HYBRID.

  Default: `null`.
</ParamField>

## Get executive summary inbound email protection breakdown

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_inbound_email_protection_breakdown`

Get breakdown of inbound email protection metrics for the specified cluster and time range. This endpoint mirrors the Dashboard › Executive Summary › Inbound Email Protection Breakdown card. Calls GET /api/v1/dash/reports/executive-summary/inbound-email-protection-breakdown.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="clusterId" type="string" required>
  Cluster ID for the request.
</ParamField>

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-31T23:59:59.000Z).
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-01T00:00:00.000Z).
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get executive summary inbound protection overview

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_inbound_protection_overview`

Get an overview of inbound protection metrics including messages processed, threats detected, and protection effectiveness. Calls GET /api/v1/dash/reports/executive-summary/inbound-protection-overview.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-31T23:59:59Z).
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format (e.g., 2024-01-01T00:00:00Z).
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get executive summary industry comparison

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_industry_comparison`

Get industry comparison metrics to compare your company's data (quarterly) with up to 3 industries. Calls GET /api/v1/dash/reports/executive-summary/industry-comparison.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="startMonth" type="string" required>
  Starting month for the comparison period in ISO 8601 format (e.g., 2026-01).
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="industries" type="array[string] | null">
  List of industry verticals to compare against. Maximum 3 verticals allowed. Use key values from list\_industries. Defaults to Customer's default.

  Default: `null`.
</ParamField>

## Get executive summary threat categories

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_threat_categories`

Get a breakdown of threats by category for the specified time period. Calls GET /api/v1/dash/reports/executive-summary/threat-categories.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get executive summary threat landscape effectiveness

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_threat_landscape_effectiveness`

Get threat landscape and effectiveness metrics with various breakdown options. Calls GET /api/v1/dash/reports/executive-summary/threat-landscape-effectiveness.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="breakDownBy" type="string | null">
  Breakdown dimension. Valid values: actors, malware, families, techniques, threat-objectives. Defaults to threat-objectives.

  Default: `null`.
</ParamField>

<ParamField path="count" type="string | null">
  Number of results to return. Valid values: top5, top10. Defaults to top5.

  Default: `null`.
</ParamField>

<ParamField path="messageStatus" type="string | null">
  Message status filter. Valid values: volume, delivered, clicks. Defaults to volume.

  Default: `null`.
</ParamField>

## Get executive summary top clickers

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_top_clickers`

Get information about users who have clicked on the most malicious links (Top Clickers). Calls GET /api/v1/dash/reports/executive-summary/top-clickers.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get executive summary very attacked people

Action ID: `tools.proofpoint_threat_protection.get_executive_summary_very_attacked_people`

Get information about the most targeted individuals in the organization (Very Attacked People). Calls GET /api/v1/dash/reports/executive-summary/very-attacked-people.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get organization historical attack index trending

Action ID: `tools.proofpoint_threat_protection.get_organization_historical_attack_index_trending`

Get historical attack index trend data with comparison against selected benchmarks. Calls GET /api/v1/dash/reports/organization-reports/historical-attack-index-trending.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="interval" type="string" required>
  Time interval for trending data. Valid values: 1Y, MAX.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="comparison" type="array[string] | null">
  List of comparison benchmarks (e.g., industry verticals, CUSTOMER\_YEAR\_OVER\_YEAR). Maximum 4 options allowed. Valid vertical names or CUSTOMER\_YEAR\_OVER\_YEAR. Note: CUSTOMER\_YEAR\_OVER\_YEAR is only allowed when interval=1Y.

  Default: `null`.
</ParamField>

## Get organization industry comparison

Action ID: `tools.proofpoint_threat_protection.get_organization_industry_comparison`

Compares organization's threat metrics against selected industry verticals over a specified interval. Calls GET /api/v1/dash/reports/organization-reports/industry-comparison.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="interval" type="string" required>
  Time interval for comparison. Valid values: MONTH, QUARTER.
</ParamField>

<ParamField path="startMonth" type="string" required>
  Start month in YYYY-MM format. Must be valid YYYY-MM format within allowed range: from last 13 months to current month minus interval value (MONTH=1, QUARTER=3).
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="industries" type="array[string] | null">
  List of industry verticals. Maximum 3 allowed. Valid industry names. Defaults to Customer's default.

  Default: `null`.
</ParamField>

## Get people targeted by BEC threats

Action ID: `tools.proofpoint_threat_protection.get_bec_targeted_people`

Get all people targeted by BEC threats. Calls GET /api/v1/dash/reports/bec-reports/people-targeted-by-bec-threats.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get people top 10 clickers

Action ID: `tools.proofpoint_threat_protection.get_people_top_ten_clickers`

Get top 10 users who clicked on the most malicious URLs. Calls GET /api/v1/dash/reports/people-reports/top-ten-clickers.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get people top 10 isolated clickers

Action ID: `tools.proofpoint_threat_protection.get_people_top_ten_isolated_clickers`

Get top 10 users who had the most clicks isolated by Browser Isolation. Calls GET /api/v1/dash/reports/people-reports/top-ten-isolated-clickers.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get people top 10 recipients

Action ID: `tools.proofpoint_threat_protection.get_people_top_ten_recipients`

Get top 10 users who received the most threat messages. Calls GET /api/v1/dash/reports/people-reports/top-ten-recipients.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get people VIP activity

Action ID: `tools.proofpoint_threat_protection.get_people_vip_activity`

Get VIP activity and threat statistics. Calls GET /api/v1/dash/reports/people-reports/vip-activity.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape overview headline

Action ID: `tools.proofpoint_threat_protection.get_landscape_overview_headline`

Get headline statistics for the threat landscape overview. Calls GET /api/v1/dash/reports/landscape-reports/overview-headline.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape spread and targeting

Action ID: `tools.proofpoint_threat_protection.get_landscape_spread_and_targeting`

Get spread and targeting metrics. Calls GET /api/v1/dash/reports/landscape-reports/spread-and-targeting.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape threat campaigns vs individual threats

Action ID: `tools.proofpoint_threat_protection.get_landscape_threat_campaigns_vs_individual_threats`

Get comparison of threat campaigns versus individual threats. Calls GET /api/v1/dash/reports/landscape-reports/threat-campaigns-vs-individual-threats.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape threat categories

Action ID: `tools.proofpoint_threat_protection.get_landscape_threat_categories`

Get threat category statistics for the threat landscape reports. Calls GET /api/v1/dash/reports/landscape-reports/threat-categories.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape threat types by message volume

Action ID: `tools.proofpoint_threat_protection.get_landscape_threat_types_by_message_volume`

Get threat types aggregated by message volume. Calls GET /api/v1/dash/reports/landscape-reports/threat-types-by-message-volume.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape top 10 actors

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_actors`

Get top 10 threat actors for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-actors.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 campaigns

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_campaigns`

Get top 10 threat campaigns for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-campaigns.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 domains sending threats

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_domains_sending_threats`

Get top 10 domains sending threat messages. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-domains-sending-threats.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 families

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_families`

Get top 10 threat families for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-families.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 malware

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_malware`

Get top 10 malware threats for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-malware.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 root domains for URL attacks

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_root_domains_for_url_attacks`

Get top 10 root domains used in URL-based attacks. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-root-domains-for-url-attacks.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 subdomains for URL attacks

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_subdomains_for_url_attacks`

Get top 10 subdomains used in URL-based attacks. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-subdomains-for-url-attacks.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top 10 techniques

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_ten_techniques`

Get top 10 attack techniques for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-ten-techniques.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="queryType" type="string | null">
  Query type. Valid values: by-volume, by-delivered, by-clicks. Defaults to by-volume.

  Default: `null`.
</ParamField>

## Get threat landscape top BEC themes

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_bec_themes`

Get top BEC themes for the threat landscape. Calls GET /api/v1/dash/reports/landscape-reports/top-bec-themes.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape top threat objectives

Action ID: `tools.proofpoint_threat_protection.get_landscape_top_threat_objectives`

Get top threat objectives across the specified time range. Calls GET /api/v1/dash/reports/landscape-reports/top-threat-objectives.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat landscape trend

Action ID: `tools.proofpoint_threat_protection.get_landscape_trend`

Get threat landscape trend data with configurable grouping and breakdown. Calls GET /api/v1/dash/reports/landscape-reports/landscape-trend.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="breakdownBy" type="string | null">
  Breakdown dimension. Valid values: OBJECTIVES, FAMILIES, MALWARE, ACTORS, TECHNIQUES, THEME. Defaults to OBJECTIVES.

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to WEEK.

  Default: `null`.
</ParamField>

## Get threat landscape vertically targeted activity

Action ID: `tools.proofpoint_threat_protection.get_landscape_vertically_targeted_activity`

Get vertically targeted threat activity. Calls GET /api/v1/dash/reports/landscape-reports/vertically-targeted-activity.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat objectives industry comparison

Action ID: `tools.proofpoint_threat_protection.get_threat_objectives_industry_comparison`

Compares threat objectives against selected industry verticals. Calls GET /api/v1/dash/reports/threat-objectives-reports/industry-comparison.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="industries" type="array[string] | null">
  List of industry verticals. Maximum 3 allowed. Valid industry names. Defaults to Customer's default.

  Default: `null`.
</ParamField>

## Get threat objectives messages protected

Action ID: `tools.proofpoint_threat_protection.get_threat_objectives_messages_protected`

Get messages protected statistics grouped by threat objectives. Calls GET /api/v1/dash/reports/threat-objectives-reports/messages-protected.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get threat objectives trend

Action ID: `tools.proofpoint_threat_protection.get_threat_objectives_trend`

Get threat objectives trend data over time. Calls GET /api/v1/dash/reports/threat-objectives-reports/threat-objectives-trend.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="groupBy" type="string | null">
  Time grouping. Valid values: DAY, WEEK, MONTH, QUARTER. Allowed values depend on date range: 0-13 days: DAY only; 14-30 days: DAY, WEEK; 31-89 days: DAY, WEEK, MONTH; 90 days: WEEK, MONTH, QUARTER. Defaults to WEEK.

  Default: `null`.
</ParamField>

## Get top BEC themes

Action ID: `tools.proofpoint_threat_protection.get_bec_top_themes`

Get top BEC themes for the specified time range. Calls GET /api/v1/dash/reports/bec-reports/top-bec-themes.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get very attacked people summary

Action ID: `tools.proofpoint_threat_protection.get_very_attacked_people_summary`

Get summary statistics for Very Attacked People (VAP). Calls GET /api/v1/dash/reports/people-reports/very-attacked-people/summary.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## Get VIPs targeted by BEC threats

Action ID: `tools.proofpoint_threat_protection.get_bec_targeted_vips`

Get VIPs targeted by BEC threats. Calls GET /api/v1/dash/reports/bec-reports/vips-targeted-by-bec-threats.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## List actors

Action ID: `tools.proofpoint_threat_protection.list_actors`

Get a paginated and sorted list of top threat actors for the specified time range. Calls GET /api/v1/dash/reports/actor-reports/actors.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time for the reporting period in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page number for pagination. Non-negative integer. Defaults to 0.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Number of results per page. Positive integer. Defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="sortBy" type="string | null">
  Field to sort by. Valid values: ATTACK\_INDEX, DISTINCT\_THREATS. Defaults to ATTACK\_INDEX.

  Default: `null`.
</ParamField>

<ParamField path="sortOrder" type="string | null">
  Sort order. Valid values: ASC, DESC. Defaults to DESC.

  Default: `null`.
</ParamField>

## List industries

Action ID: `tools.proofpoint_threat_protection.list_industries`

Get a list of available industries/verticals for use in filtering and comparison operations. Calls GET /api/v1/dash/reports/industries.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

## List mail bomb events

Action ID: `tools.proofpoint_threat_protection.list_mail_bomb_events`

List email bomb events detected for the organization in a time range with GET /api/v1/dash/reports/mail-bomb-events. The range can be at most 90 days and start at most 365 days ago.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Email\_Bomb\_Events\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Email_Bomb_Events_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End of the time range in ISO 8601 UTC format, e.g. 2024-01-31T23:59:59Z.
</ParamField>

<ParamField path="start" type="string" required>
  Start of the time range in ISO 8601 UTC format, e.g. 2024-01-01T00:00:00Z.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Zero-based page number. Defaults to 0.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Number of events per page. Defaults to 100.

  Default: `null`.
</ParamField>

## List very attacked people

Action ID: `tools.proofpoint_threat_protection.list_very_attacked_people`

Get the list of Very Attacked People (VAP) with detailed information. Calls GET /api/v1/dash/reports/people-reports/very-attacked-people/list.

Reference: [https://help.proofpoint.com/Threat\_Insight\_Dashboard/API\_Documentation/Reports\_API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API)

### Secrets

Required secrets:

* `proofpoint_threat_protection_oauth`: OAuth token `PROOFPOINT_THREAT_PROTECTION_SERVICE_TOKEN`.

### Input fields

<ParamField path="end" type="string" required>
  End time in ISO 8601 UTC format.
</ParamField>

<ParamField path="start" type="string" required>
  Start time in ISO 8601 UTC format.
</ParamField>

<ParamField path="base_url" type="string | null">
  Proofpoint Threat Protection API base URL. Defaults to [https://threatprotection-api.proofpoint.com](https://threatprotection-api.proofpoint.com).

  Default: `null`.
</ParamField>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.