Proofpoint

• Threat deliveredRuns for each message with a known threat that Proofpoint delivered to an inbox, such as a phishing link it condemned after delivery. Ones from before the workflow is turned on don't start it. It checks every 10 minutes at most, to keep within Proofpoint's daily limit.
• Threat blockedRuns for each message with a known threat that Proofpoint blocked or quarantined. Ones from before the workflow is turned on don't start it. It checks every 10 minutes at most, to keep within Proofpoint's daily limit.
• Malicious click permittedRuns each time someone clicks a malicious link and Proofpoint lets the click through. Ones from before the workflow is turned on don't start it. It checks every 10 minutes at most, to keep within Proofpoint's daily limit.
• Malicious click blockedRuns each time someone clicks a malicious link and Proofpoint blocks it. Ones from before the workflow is turned on don't start it. It checks every 10 minutes at most, to keep within Proofpoint's daily limit.
• New campaignRuns for each threat campaign Proofpoint sees aimed at your organization for the first time, with its id for 'Get campaign'. Campaigns already active when the workflow is turned on don't start it. It checks every two hours at most, to keep within Proofpoint's limit of 50 a day.
• New Very Attacked PersonRuns each time someone joins your Very Attacked People over the last 30 days, including someone who left the list and comes back. People already on it when the workflow is turned on don't start it. It checks every six hours at most.
• New top clickerRuns each time someone joins your top clickers (the people who clicked the most malicious links over the last 30 days), including someone who comes back. People already on it when the workflow is turned on don't start it. It checks every six hours at most.

• List all threat eventsList every message with a threat, delivered or blocked, and every click on a malicious link, permitted or blocked, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List issuesList what got through: messages with a threat that were delivered and clicks on malicious links that were permitted, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List delivered threat messagesList messages with a known threat that were delivered to inboxes, with their sender, recipients, scores and threats, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List blocked threat messagesList messages with a known threat that Proofpoint blocked or quarantined, with the quarantine folder and rule, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List permitted clicksList clicks on malicious links that Proofpoint let through, with who clicked, when and from where, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List blocked clicksList clicks on malicious links that Proofpoint blocked, with who clicked, when and from where, in a window. Reads up to an hour, in the last seven days; leave Start and End empty for the last hour.
• List campaignsList the threat campaigns that were active against your organization in a window of up to a day (the last day if Start and End are empty). Proofpoint allows 50 of these a day.
• Get campaignGet a threat campaign with its description, the actors behind it, its malware, techniques and imitated brands, and the threats in it.
• Get forensicsGet the evidence Proofpoint's sandbox found for a threat or a whole campaign: links, DNS lookups, network traffic, files and screenshots. Give a threat or a campaign.
• Get threatGet a threat's summary: its type and category, status, severity, how many other Proofpoint customers received it, and the actors, malware and brands involved.
• List Very Attacked PeopleList your Very Attacked People: the people targeted most, with their attack index and the threat families aimed at them. Proofpoint allows 50 of these a day.
• List top clickersList the people who clicked malicious links most often, whether or not the clicks were blocked, with their click counts. Proofpoint allows 50 of these a day.
• Decode URLsGet the original links behind links Proofpoint URL Defense rewrote (urldefense.proofpoint.com or urldefense.com), with the message and recipient each was rewritten for. Up to 100 at a time.

No actions match that.