T Techclick ← Proofpoint hub
Proofpoint · Email Protection + TAP · Session factory · Interactive lesson

Proofpoint is a mail-path factory. MX, TAP, then click-time.

Ticket INC-LAB-1042 lands at 09:12. The CFO says a CEO mail is missing and wants the domain whitelisted. Students answer “spam filter.” That is not a factory sentence. Proofpoint manufactures a mail path: MX hits the Proofpoint Protection Server, the filter / TAP line stamps the message, PPS writes a disposition, and TAP URL Defense can still fire a later click-time verdict. This lesson is that order, the official SIEM field names, and the proof that closes the ticket.

22 min read · L2 primary · Quiz at end · Dummy lab only

⚡ Quick Answer

Proofpoint is a mail-path factory: MX → filter/TAP → disposition → click-time TAP. Official SIEM fields, Side A/B/C runbook, TAP Dashboard mocks, scored quiz.

After this page you can

Quick answer

Proofpoint is a mail-path factory. Inbound MX lands on a Proofpoint Protection Server (PPS) cluster. PPS filter modules and Targeted Attack Protection (TAP) stamp the message — Attachment Defense sandboxes the file, URL Defense rewrites remaining links to the URL Defense Redirector. Official disposition is then messagesBlocked (quarantined by PPS) or messagesDelivered (delivered by PPS). A later user click is a new TAP event (clicksPermitted / clicksBlocked, clickTime). Success is a quoted GUID + named event — not the word “spam.”

Say this out loud

I do not start with a whitelist. I ask whether MX hit this PPS cluster, which modules ran, whether TAP Attachment or URL Defense stamped the message, whether PPS quarantined or delivered it, and whether anyone later clicked a rewritten URL. Delivery is not click-time. Click-time is not a missing MX.

Concept

One mail-path ticket. PPS prints the hop. TAP writes the threat stamps. Disposition is the hold. Click-time is a later walk through the same factory.

Path

MX → PPS filter / TAP → messagesBlocked or messagesDelivered → mailbox → URL Defense Redirector at click → TAP click event.

Do

Side A points MX at the cluster you own. Side B turns on TAP rewrite and attachment sandbox. Side C quotes GUID + disposition or clickTime.

Desk

Night-shift “is Proofpoint working?” is five proof tools. That write-up lives on the evidence desk. This page is the factory that desk inspects.

1. Why “spam” is not a mail path

Every other blog starts with TAP, Impersonation, and DMARC as three marketing boxes. That is why students freeze in interviews. The real object is the mail path. Features are only stamps the factory puts on a message before it lets the mailbox, or a later click, happen.

Official SIEM overview: TAP events are blocked or permitted clicks recognized by URL Defense, and blocked or delivered messages that contain threats recognized by URL Defense or Attachment Defense. The first hop is still PPS. Official: clusterId is “the name of the PPS cluster which processed the message.” Same envelope on a different cluster is a different factory job.

Hero · the factory floor
Teaches: a user message hits MX, walks the PPS/TAP factory, and receives stamps before the mailbox
Notice: Proofpoint does not “spam a packet.” It tries to manufacture a mail path and stamp it — then it may stamp the click later.

What the ticket asked

“Spam filter ate the CEO mail.” That sentence is a hypothesis. The factory may already have quarantined a TAP threat and printed a correct hold.

What you prove first

Which PPS cluster, then whether a GUID exists, then blocked vs delivered, then whether anyone clicked. The evidence desk is the night-shift version of this order.

Hard words before the runbook. PPS is the Proofpoint Protection Server — the filter node that owns GUID, QID, clusterId, policyRoutes, and modulesRun. TAP is Targeted Attack Protection — Attachment Defense plus URL Defense. Disposition here is the official event type: messagesBlocked = quarantined by PPS, messagesDelivered = delivered by PPS. That is not messageParts/disposition (inline vs attached). Click-time is the second verdict, when the user actually hits a rewritten URL on the URL Defense Redirector. Impostor is the official SIEM classification for BEC / message-text threats. sandboxStatus is Attachment Defense’s verdict on a message part.

The lie every L1 repeats

“The spam filter is too aggressive — whitelist the domain.” An allow-list only means the factory was told to skip stamps. If TAP already wrote classification=Phish and messagesBlocked, widening the sender just prints more delivered threats. Name the station that acted.

2. Mental model — ticket plus four stamps

Hold four parts. Interviews fail when people mix them.

1. The ticket is the mail path

One envelope, one PPS GUID (unique), one clusterId. QID and header messageID are not unique. messageTime is when PPS delivered or quarantined.

2. The stamps are TAP + scores

Attachment Defense = is the file sick (sandboxStatus). URL Defense = were remaining URLs rewritten (completelyRewritten). Scores (spamScore, phishScore, impostorScore, malwareScore) are 0–100 certainty, not the hold.

3. The hiring manager is disposition

messagesBlocked = quarantined by PPS. messagesDelivered = delivered by PPS — and can still carry a later-condemned threat. quarantineRule + policyRoutes name the object that acted.

4. Proof is GUID, then clickTime

Email Protection message search / Smart Search is the live table for the hop. TAP Dashboard Threat Detail is the stamp. clickTime is a later walk. Reports API calls the two eras preDeliveryProtected vs postDeliveryProtected.

Flow 1 · one ticket, four stamps, two times
GUID a11c4e20-lab5 · one envelope, two timestamps Sender MX partner.example Mailbox cfo@lab.example messageTime 09:12Z · PPS hop clickTime 10:43Z · later TAP event — not the hop Attachment stamp sandboxStatus threat · or inprogress URL stamp completelyRewritten true · false · na Disposition stamp blocked vs delivered quarantineFolder Click-time stamp clicksPermitted or clicksBlocked PPS prints the ticket. TAP writes Attachment / URL / Message on threatsInfoMap. classification = Malware · Phish · Spam · Impostor (BEC / message-text) · TOAD threatType = Attachment · URL · Message. Smart Search is where you read the finished hop. Source: help.proofpoint.com SIEM API — Message Events + Click Events

Read the solid arrow first (PPS hop / messageTime). If the dashed click stays empty, do not invent a click incident. Re-read stamps before you touch a filter.

Attachment Defense answers “is this part sick?” Official messageParts/sandboxStatus: threat = sandbox returned malicious; clean = clean; prefilter = no active content, not sent to sandbox; uploaded / inprogress = uploaded, no verdict yet at process time; uploaddisabled = eligible but PPS policy did not upload; unsupported = Attachment Defense does not scan this part. Pending is not mail-down.

URL Defense answers “did we rewrite remaining URLs for click-time protection?” Official Help: URL Defense rewrites URLs to the URL Defense Redirector so they survive forwarding. Hosts you will see: urldefense.proofpoint.com (v1/v2) and urldefense.com (v3). completelyRewritten is true (all URL threats rewritten), false (at least one threat URL was not), or na (no URL-based threats).

Disposition answers “did PPS quarantine or deliver?” Official: messagesBlocked = messages with threats which were quarantined by PPS. messagesDelivered = messages with threats which were delivered by PPS. On blocked events also quote quarantineFolder and quarantineRule. Do not quote MIME messageParts/disposition=attached as “it landed.”

Click-time answers “did someone actually walk the rewritten link?” Official click fields: clickTime, clickIP (may be the NAT/firewall address), url, userAgent, classification (Malware / Phish / Spam), GUID (ties back to the PPS message). Endpoints: /v2/siem/clicks/permitted and /v2/siem/clicks/blocked.

3. MX setup vs click-time path

The first hop of a new envelope has no TAP click yet. It walks PPS processing — MX → cluster → modules → TAP attachment / URL rewrite → disposition. A later click of the same GUID skips that queue and rides the URL Defense Redirector. That is why “mail was delivered clean” sometimes does nothing when the user clicks an hour later.

Path · first hop vs click-time
Teaches: a disposition diamond splits pre-delivery PPS hold from later click-time TAP
Notice: the diamond is not allow/deny. It is “is this a PPS hop event or a later click on a rewritten URL?”
Flow 2 · official mail-path order (student labels)
MX → session lookup → PPS setup or click-time 1 MX points at PPS Click? same GUID no SETUP / first hop — print a new mail ticket first SMTP of this envelope on this cluster Cluster clusterId Routes policyRoutes Modules modulesRun Sandbox Attachment Rewrite URL Defense Scores spam · phish Disposition block or deliver CLICK-TIME — later walk of the same GUID on the Redirector decode rewritten URL · re-check destination · clicksPermitted or clicksBlocked · clickTime ≠ messageTime yes → skip hop Official facts students invert 1. TAP SIEM only returns click and message events relating to known threats. Empty SIEM is not “PPS is down.” 2. Event-create time ≠ messageTime / clickTime. A sinceSeconds=3600 pull can surface a click from days ago. 3. First-hop lookup uses PPS modules + policy routes. TAP click uses the rewritten URL, not a second MX. 4. After threatTime updates, a delivered message can become a post-delivery protected event. That is TAP working. Source: SIEM API Overview + Note About Event Time · How do I decode a rewritten URL? · Reports API pre/post-delivery Default: GUID unique in PPS. QID and messageID are not. clickIP may be the NAT address, not the laptop. All timestamps in returned TAP events are UTC.

Read left → right, then the green click-time bar. Decision diamond = “is this already a click on a rewritten URL?” Disposition sits after TAP stamps on purpose.

#1 student trap — sandboxStatus inprogress

The first minutes of a risky attachment are still just “uploaded.” Official: uploaded means PPS sent the part to the sandboxing service but did not yet have a verdict at process time; inprogress means it was awaiting scanning. That is not a down cluster and not a reason to release. If your filter says “Finance is waiting,” those first minutes must still exist long enough for Attachment Defense to finish — the same way a PAN-OS session must live long enough for App-ID. inprogress with no GUID is a different ticket (MX never arrived).

4. How to choose the next stamp

You are not choosing a product. You are choosing what the factory is allowed to write on the ticket.

ChoiceUse whenDo not use whenProof you were right
Leave TAP Attachment on Every inbound allow that can carry a file. Official sandbox is how threatType=Attachment gets a chance. You set policy that yields sandboxStatus=uploaddisabled so Finance is not delayed. sandboxStatus is threat / clean / prefilter — not silently disabled.
URL Defense rewrite remaining URLs Production inbound. Click-time protection requires the Redirector rewrite. You disable rewrite because a vendor “cannot parse urldefense.” Scoped decoder + exception, owner + expiry. completelyRewritten=true on URL threats; decoder returns decodedUrl.
Keep messagesBlocked classification is Phish, Malware, Impostor, or TOAD and quarantineFolder names TAP / sandbox. CFO asks for a release and you have not read threatsInfoMap. Event type stays messagesBlocked. Hunt similar; do not release on request.
Treat messagesDelivered as a live threat TAP later condemned the URL or file. Official: delivered messages can contain known threats. You close because “it landed, so we are fine.” messagesDelivered + classification + later clickTime or post-delivery retract.
Filter policy quarantine (Essentials) You have a documented country / sender condition. Official path: Security Settings → Email → Filter Policies, Direction Inbound, Company Level. You use a geo filter to “fix” an Impostor CEO. That is the wrong stamp. Message detail Client GeoIP Lookup matches the IF clause; usage stats increment.
People / VAP after the hop You already have the GUID. Official People API: Very Attacked People + top clickers (blocked or permitted). You start a missing-mail ticket in VAP. /v2/people/vap or /v2/people/top-clickers after the hop is proved.

completelyRewritten is a rewrite contract, not a vibe. Official wording: true means all instances of URL threats were successfully rewritten; false means at least one threat URL was not; na means the message did not contain URL-based threats. Source: SIEM API Message Events.

5. Runbook Side A → B → C

Lab values only. Cluster pps-lab-us1, recipient cfo@lab.example, sender domain partner.example, GUID a11c4e20-lab5-4b21-9e03-ppfact0001042, QID LAB-QID-1042, threat URL host login.example-secure.test. Nothing here is a live tenant.

Side A — MX, cluster, authentication (building the factory floor)

Primary source: SIEM API Message Events (clusterId, GUID, senderIP) + URL Decoder API (clusterName of the PPS cluster which rewrote the message).

  1. Point inbound MX at the PPS cluster you own

    Inbound MX must resolve to this lab’s Email Protection / PPS cluster, not the mailbox and not a different geography. Official: clusterId is the name of the PPS cluster which processed the message. If you search TAP on the wrong cluster, you invent a miss.

  2. Prove the hop before you tune a filter

    Email Protection → Smart Search (message search). Filter recipient + UTC window. Quote GUID (unique in PPS), clusterId, messageTime. Empty search for that recipient + UTC means PPS never processed it — next check is MX / DNS / TLS to the cluster, not a TAP Threat Detail.

  3. Do not treat a vendor auth fail as “Proofpoint is down”

    SIEM scores (spamScore, phishScore, impostorScore) are 0–100 certainty. A legitimate vendor who changed ESP often fails alignment and lands in a filter or Impostor path. That is their DNS plus your policyRoutes — not a cluster bounce. A scoped exception with an owner and an expiry, not org-wide TAP off.

Side B — TAP and filter policy (printing the ticket, choosing stamps)

Primary source: SIEM API (URL Defense + Attachment Defense event types) + How do I decode a rewritten URL? + Essentials Filter Policies path when you are on that SKU.

  1. Keep Attachment Defense able to upload

    Path: TAP Dashboard → Threats / Threat Detail on the GUID you already have. Confirm modulesRun includes the sandbox module and sandboxStatus is not stuck on uploaddisabled because someone “sped up Finance.” Official: uploaddisabled means the part was eligible but was not uploaded because of PPS policy.

  2. Keep URL Defense rewrite + click-time

    Official Help: as part of providing click-time protection, URL Defense rewrites URLs to the URL Defense Redirector. Decode on TAP Dashboard → Tools → URL Decoder, or POST /v2/url/decode. Authenticated decode also returns messageGuid, clusterName, recipientEmail.

  3. Write inbound filter policy only when the condition is yours

    On Essentials SKUs the documented path is Security Settings → Email → Filter Policies. Direction = Inbound. Scope = Company Level. Example official logic: IF Client IP Country IS <country> DO Quarantine AND (optional) Require Admin Privileges to Release. This is not a TAP replacement.

  4. Save, then do not celebrate

    A saved filter or a green TAP card means the recipe printed. It does not mean the CFO’s message is the hop you think it is. Side C is the proof.

Predicted TAP SIEM shape — Techclick dummy lab 
GET https://tap-api-v2.proofpoint.com/v2/siem/messages/blocked
    ?format=json&interval=2026-08-16T09:00:00Z/2026-08-16T10:00:00Z
    --user "$PRINCIPAL:$SECRET"

messagesBlocked[0]:
  GUID:              a11c4e20-lab5-4b21-9e03-ppfact0001042
  QID:               LAB-QID-1042
  clusterId:         pps-lab-us1
  messageTime:       2026-08-16T09:12:18.000Z
  recipient:         cfo@lab.example
  quarantineFolder:  Attachment Defense
  quarantineRule:    module.sandbox.threat
  policyRoutes:      ["default_inbound","executives"]
  modulesRun:        ["spam","sandbox","urldefense"]
  threatsInfoMap[0].classification: Phish
  threatsInfoMap[0].threatType:     Attachment
  messageParts[0].sandboxStatus:    threat
  completelyRewritten:              na

Say the word predicted if you only have SIEM. The live click may still be absent. Compare this block to TAP Dashboard Threat Detail and, if anyone clicked, to /v2/siem/clicks/permitted in Side C. Service principal and secret are created on the TAP Dashboard Settings page. Official: all timestamps UTC; max query window 1 hour; lookback 7 days.

Side C — prove the hop, then the click

Primary source: SIEM API Click Events + How do I decode a rewritten URL? + Reports API pre-delivery vs post-delivery.

  1. Baseline the cluster, then the GUID

    Smart Search must show clusterId=pps-lab-us1 and the GUID in the ticket’s UTC window — or you can show the empty search and move to MX. Half of “it doesn’t match the doc” is the wrong TAP instance. Half of empty TAP SIEM is ordinary mail with no known threat.

  2. Read the stamps on Threat Detail

    You need event type messagesBlocked or messagesDelivered, a classification, a threatType, and on a hold also quarantineFolder + quarantineRule. Copy the GUID for the click hunt.

  3. If the user clicked, treat two timestamps

    Official: clickTime is “the time the user clicked on the URL.” It is not messageTime. Decode the rewritten URL on Tools → URL Decoder. Then read clicksPermitted vs clicksBlocked. A permitted click is an incident, not “mail was delivered clean.”

  4. If s2c analog is empty — no click and a hold — do not add a whitelist

    Check MX / cluster, policyRoutes, and the sandbox. That is the evidence desk, not a missing allow-list.

Proof · TAP Dashboard cockpit
Teaches: operators prove a mail-path ticket on TAP Dashboard fields, not from the word spam
Notice: juniors stare at “spam.” Seniors stare at GUID, messagesBlocked, and clickTime.
Live click — dummy lab, not a customer tenant 
GET https://tap-api-v2.proofpoint.com/v2/siem/clicks/permitted
    ?format=json&interval=2026-08-16T10:00:00Z/2026-08-16T11:00:00Z

clicksPermitted[0]:
  GUID:           a11c4e20-lab5-4b21-9e03-ppfact0001042
  recipient:      cfo@lab.example
  clickTime:      2026-08-16T10:43:00.000Z
  clickIP:        203.0.113.10
  classification: Phish
  threatStatus:   active
  url:            https://login.example-secure.test/
  userAgent:      Mozilla/5.0 lab-browser
  campaignId:     lab-camp-1042

Note About Event Time:
  SIEM query window is event *create* time, not clickTime.
  A later condemn can surface this click hours after 10:43Z.
Green success on this runbook

Smart Search GUID + clusterId=pps-lab-us1. Event type named (messagesBlocked or messagesDelivered). On a hold: quarantineFolder + classification. On a click: clickTime ≠ messageTime, plus permitted vs blocked. Application of the factory left “spam” and became a named TAP or filter object. A whitelist with no GUID is not success.

6. Runtime — later condemn, rewrite gaps, VAP

After the hop exists, later clicks skip PPS setup and ride the Redirector. Official click-time Help: rewritten URLs point at the URL Defense Redirector service and are specially encoded to survive forwarding. That is why a forwarded CFO mail still shows urldefense.proofpoint.com / urldefense.com and why decode is a first-class tool, not a hobby.

If the application — here, the threat — is not yet known at hop time, Attachment Defense may log uploaded or inprogress. After the sandbox names the file, TAP can condemn later. Official SIEM note: event-create time is always after messageTime / clickTime or after threatsInfoMap/threatTime (when Proofpoint recognized and condemned the threat). A sinceSeconds=3600 pull can therefore return a message first observed days ago. Students invert this and declare SIEM “late” or “down.”

URL Defense then inspects at click if the rewrite actually happened. If completelyRewritten=false, at least one threat URL left the factory without a Redirector wrapper. That is a stamp failure, not a reason to disable rewrite globally. Decode the ones that did rewrite; hunt the ones that did not; scoped exception only with an owner and an expiry. Certificate-pinned or vendor-broken parsers will scream. That is the app refusing a substitute URL — document it, do not “rewrite off for the company.”

Reports API names the two eras students collapse: preDeliveryProtectedMessages (blocked/quarantined before delivery) and postDeliveryProtectedMessages (remediated after delivery), plus potentiallyExposedMessages. Official Dashboard card: Dashboard → Executive Summary → Inbound Email Protection Breakdown. Pre-delivery is the first-hop factory. Post-delivery is TAP/TRAP working after the mailbox. Exposed is not “PPS failed”; it is the set you still have to hunt.

People is two copies of attention, not a second MX. Official People API: /v2/people/vap (Very Attacked People; window 14 / 30 / 90 days; attackIndex vs vapAttackIndexThreshold) and /v2/people/top-clickers (users who clicked malicious URLs, regardless of whether the clicks were blocked). VAP is who got attacked. Top clickers are who walked the Redirector. Neither replaces Smart Search on a missing-mail ticket.

Flow 3 · runtime after go-live
Pre-delivery messagesBlocked Delivered threat messagesDelivered Click-time clickTime Post-delivery threatTime update Reports API: preDeliveryProtected · postDeliveryProtected · potentiallyExposed People API after the hop: VAP (who was attacked) vs top-clickers (who walked the URL). Source: Reports API Executive Summary · People API vap + top-clickers

Read left → right. Delivered is not the end of the factory. Click-time and post-delivery are later stamps on the same GUID.

7. Traps + GUID / clickTime proof

SymptomLooks likeActuallyFirst move
CFO: missing CEO mail Spam filter / whitelist domain messagesBlocked + TAP classification Smart Search GUID, then Threat Detail
Allow + user clicked Mail was delivered clean Click-time is a new TAP event clickTime + permitted vs blocked
sandboxStatus uploaded / inprogress Mail is down / release now Verdict not back at process time Wait or isolate — do not release blind
Empty TAP SIEM window Proofpoint is down SIEM is known-threat events only Smart Search ordinary mail first
Added a filter, nothing changed Save failed Wrong cluster, or hop already finished Quote clusterId; re-search the GUID
messageParts/disposition=attached “Disposition says it landed” MIME only — inline vs attached Read messagesBlocked / Delivered
Vendor invoices held Disable TAP / org DMARC off quarantineRule + policyRoutes Scoped change-control, not TAP off
completelyRewritten=false Rewrite is broken, turn it off At least one threat URL skipped the wrapper Decode what did rewrite; hunt the gap
clickIP is a firewall Wrong user / spoofed click Official: NAT shows the firewall address Trust recipient + GUID, not the IP vibe
VAP list is hot, mail “missing” Start in People VAP is who was attacked, not the hop Smart Search first, People after
Proof checklist — the mail-path factory is actually working
Interview close you can steal

Proofpoint is a mail-path factory. MX lands on a PPS cluster. Filter modules and TAP stamp the message — Attachment Defense on the file, URL Defense on remaining links. Disposition is messagesBlocked or messagesDelivered. A later click is a new TAP event on the URL Defense Redirector. I prove the ticket with a GUID + clusterId, then the named event, then clickTime if someone walked the link. “Spam” without those fields is not an answer.

Related: The evidence desk · TAP URL + attachment defense · Email security map · Proofpoint hub

Knowledge check

Six judgment questions. Map each miss back to the section named in the reason.

Q1

What is the official mail-path factory order on this page?

Correct: c. The factory prints the hop, stamps TAP, writes disposition, and may stamp a later click. Re-read Quick answer and MX setup vs click-time path.
Q2

What are Attachment Defense, URL rewrite, disposition, and click-time on a Proofpoint path?

Correct: b. One envelope, four stamps. Click-time only runs if someone walks a rewritten URL. Re-read Mental model.
Q3

Smart Search shows GUID a11c4e20…, event messagesBlocked, quarantineFolder Attachment Defense, classification Phish. CFO wants a release. What do you do first?

Correct: a. Official: messagesBlocked = quarantined by PPS. User request is not residual control. Re-read Why “spam” is not a mail path and Side C.
Q4

A URL was clean at delivery (messagesDelivered). The user clicks at 10:43Z and TAP says Phish. What happened?

Correct: d. Official click fields and “How do I decode a rewritten URL?”: rewrite exists for click-time protection. Re-read Runtime and Side C.
Q5

sandboxStatus is uploaded or inprogress. User says mail never arrived. What is true?

Correct: b. SIEM Message Events: uploaded / inprogress mean no verdict yet at process time. uploaddisabled is a PPS policy skip. Re-read Mental model and the #1 trap.
Q6

What proves the mail-path factory is actually working for INC-LAB-1042?

Correct: c. Smart Search is the hop. TAP SIEM is known-threat events only. Commit/save is a recipe. Re-read Side C and the proof checklist.

Sources

Related: Prove Proofpoint is working — evidence desk · TAP URL + attachment defense · Email security map · TRAP auto-pull · Proofpoint interview hub

All GUIDs, recipients, and cluster names on this page are fictional lab data. Confirm live syntax and privacy rules before you type on a real tenant.