Prove Proofpoint is working — first tool + proof field

1. Why “is it working?” is five questions

Operators collapse five failures into one sentence. The MX never pointed at PPS. TAP never saw a threat, so SIEM is empty. Attachment Defense quarantined the CEO lookalike. A rewritten URL flipped malicious an hour after delivery and the user clicked. A new policy route held every vendor invoice. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught the inbound line — MX → PPS → TAP → rewrite → mailbox → click-time → TRAP. Here you learn the five tools you actually open, in order, when someone asks you to prove Proofpoint is working or to explain why a message landed.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you release a TAP quarantine or disable URL Defense at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open the filter editor, a domain allow-list, or TRAP auto-pull until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the TAP Dashboard. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the wire: did PPS see this message? Side B proves the TAP verdict, the disposition, and the rule. Side C proves the click the user felt, then TRAP. On a messy Sev-2, do them in this order until a field lights up.

Side A — Smart Search (did it hit PPS?)

1. Write recipient + subject + UTC before you click

   Copy the mailbox, the approximate send time in UTC, and any Message-ID the user pasted. SIEM Help: all timestamps in returned events are UTC. SIEM query time is event create time, not always messageTime. If you search the wrong hour you will invent an outage.

2. Open Smart Search, not the filter editor

   Path: Email Protection → Smart Search. Official TRAP data sheet names Smart Search as a source TRAP uses to find and retract mail. Filter recipient + time window. Add subject or sender domain if you already know it.

3. Read the three columns that prove the wire

   GUID — “the ID of the message within PPS… guaranteed to be unique.” QID — queue ID, “not unique.” messageID — header Message-ID, “not unique.” Quote GUID + clusterId + messageTime. Source: SIEM API — Message Events.

4. If Smart Search is empty, stop hunting TAP

   Empty search for that recipient + UTC means PPS never processed the message. Next check is MX / DNS / smarthost / TLS to the cluster — not quarantineRule, not a TAP Threat Detail, not a TRAP pull. A green cluster LED on someone else’s screen is not this user’s GUID.

Side B — TAP threat, disposition, rule

1. Open Threat Detail on the GUID you already have

   Path: TAP Dashboard https://threatinsight.proofpoint.com → Threats → Threat Detail. Official Threat API: the threat ID is the URL suffix of the Threat Detail page (…/threat/email/<threatId>). Same fields stream from SIEM /v2/siem/messages/blocked and /v2/siem/messages/delivered.

2. Read classification, then threatType, then threatStatus

   Official threatsInfoMap/classification: Malware, Phish, Spam, Impostor (BEC / message-text), TOAD. threatType: Attachment, URL, Message. threatStatus: active, falsepositive, cleared. Impostor is not “spam.” Do not say spam when the field says Phish or Impostor.

3. Read the event type — that is the disposition

   messagesBlocked = “messages with threats which were quarantined by PPS.” messagesDelivered = “messages with threats which were delivered by PPS.” On blocked events also quote quarantineFolder (official example: Attachment Defense).

4. Then the rule — only after the event type

   quarantineRule = “the name of the rule which quarantined the message. This appears only for messagesBlocked events.” Official example: module.sandbox.threat. policyRoutes = routes matched during PPS processing (example: default_inbound, executives). modulesRun proves which engines actually ran.

Path:            TAP Dashboard → Threat Detail  (or SIEM messages/blocked)
GUID:            c26dbea0-80d5-463b-b93c-4e8b708219ce
Event:           messagesBlocked
classification:  Phish
threatType:      Attachment
quarantineFolder:Attachment Defense
quarantineRule:  module.sandbox.threat
policyRoutes:    default_inbound, executives
Do not quote:    messageParts/disposition (that is MIME inline/attached)

Side C — TAP Dashboard click + TRAP

1. Treat clickTime as a second event

   Official click fields: clickTime, clickIP, classification (Malware / Phish / Spam), url, threatStatus, GUID (ties back to the PPS message). Endpoints: /v2/siem/clicks/permitted and /v2/siem/clicks/blocked. Delivery time and click time are two timestamps. TAP URL Defense re-checks at click-time.

2. Read completelyRewritten on the parent message

   Official: true = every URL threat instance was rewritten; false = at least one threat URL was not rewritten; na = no URL-based threats. A permitted click on a rewritten URL is still a people + control event. Isolation (credential reset, hunt) is not a filter edit.

3. TRAP pulls after delivery — it is not mail-down

   Official TRAP data sheet: automatically quarantine malicious mail that bypassed the perimeter; retract forwards and distribution-list copies; ingest from TAP, Smart Search, CSV, or a manual report. CLEAR sends PhishAlarm reports to an abuse mailbox, then TRAP retracts on a match. Quote the incident + recipient list. Do not page PPS because auto-pull is working.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

PPED-01 — Prove the wire (Smart Search)

01:18 · P1. Whole-company “mail is down.” Someone photographed a green node LED and still wants PPS bounced. L1 drafted a domain allow-list for *.

First tool: Email Protection → Smart Search. Filter a known-good recipient (for example priya@lab.example) and the last 30 minutes UTC. You are proving whether PPS is processing, not whether TAP found malware.

If empty: quote the empty search (recipient + UTC). Next check is MX, DNS, smarthost, or TLS to the cluster. There is no quarantineRule to chase and no TAP Threat Detail. SIEM /v2/siem/all will also look empty — TAP SIEM only returns click and message events relating to known threats.

If a row exists: quote GUID + clusterId + messageTime. Proofpoint processed mail. The incident is content, routing to one mailbox, or a downstream store — not a cluster bounce. Official: clusterId is “the name of the PPS cluster which processed the message.”

PPED-02 — Prove why it landed (TAP threat + delivered)

01:36 · P2. A credential-phish is sitting in Finance. Channel: “TAP is broken — whitelist nothing, disable URL Defense.” Someone already opened the filter editor.

First tool: TAP Dashboard Threat Detail (or SIEM messages/delivered) for that recipient + hour. You need the event type before you touch a rewrite setting.

Proof field: event = messagesDelivered; threatsInfoMap/classification = Phish (or Malware); threatType = URL or Attachment; completelyRewritten = true / false / na; threatStatus at threatTime. Official SIEM note: a message can be delivered first and condemned later — query time is event create time, which is after messageTime and after threatTime.

If completelyRewritten is false, at least one threat URL was not rewritten — that is a rewrite-coverage ticket, not “turn TAP off.” If it is true and nobody clicked, Side C is still a hunt (TRAP) but not an isolate-the-mailbox-for-fun.

PPED-03 — Prove the hold (disposition + folder)

01:52 · P2. CFO: “the CEO mail is missing — release it.” Subject looks like a wire. L1 is one click from quarantine release.

First tool: Smart Search for cfo@lab.example + subject + last hour. Then open TAP Threat Detail on the GUID.

Proof field: event = messagesBlocked (quarantined by PPS); quarantineFolder = Attachment Defense (or the folder you actually see); classification = Phish or Impostor; sandboxStatus on the attached part = threat when Attachment Defense condemned the file. Official sandbox values also include clean, prefilter, uploaded, inprogress, uploaddisabled, unsupported — uploaded / inprogress means the verdict was not back at process time.

Impostor (BEC / message-text) often has no malware hash. That is still TAP / Advanced BEC Defense, not a helpdesk release. Do not allow-list the lookalike From domain.

PPED-04 — Prove the click (TAP Dashboard)

02:11 · P1. Same CFO. “I already opened the login.” Rewrite was on. Someone typed Sev-1 “mail-down” because TRAP started pulling copies.

First tool: TAP Dashboard clicks for that recipient — SIEM clicks/permitted first, then clicks/blocked. Filter the GUID from PPED-03 if you have it.

Proof field: clickTime (not messageTime) + event clicksPermitted (or clicksBlocked) + classification + url + threatStatus. Official: clickIP may be the NAT/firewall address. GUID on the click ties it to the PPS message.

Permitted click + Phish or Malware is isolate: reset, hunt, TRAP retract of siblings. TRAP auto-pull of forwards is the product working (data sheet: retract from individuals and distribution lists). It is not a PPS outage.

PPED-05 — Prove the rule (quarantineRule + policyRoutes)

02:28 · P2. AP inbox: every vendor.example invoice since 02:00 is in quarantine. Someone wants DMARC reject off for the organisation. Last change: a new inbound policy route for finance.

First tool: Smart Search → one held invoice → rule columns. You are proving which PPS object acted, not whether TAP is “too aggressive.”

Proof field: quarantineRule (blocked events only) + policyRoutes (example pair: default_inbound, a finance/exec route) + modulesRun. If modulesRun is spam / policy and threatsInfoMap is empty or classification is Spam, this is a filter/route ticket. If classification is Impostor or Phish, do not “fix the vendor” by disabling TAP.

Vendor SPF/DKIM/DMARC breaks are Email Fraud Defense / DNS change-control with an owner and an expiry — not isolate, not org-wide reject off. Speak SPF, DKIM, and DMARC as one sentence, then name the scoped exception.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Proofpoint Help — SIEM API (GUID, QID, clusterId, messageTime, messagesBlocked / messagesDelivered, clicksPermitted / clicksBlocked, quarantineFolder, quarantineRule, policyRoutes, modulesRun, threatsInfoMap/*, completelyRewritten, messageParts/disposition, clickTime; UTC; event-create-time caveat)
• Proofpoint Help — Threat Insight Dashboard API Documentation (Campaign, Forensics, People, Reports, SIEM, Threats, URL Decoder)
• Proofpoint Help — Threats API (Threat Detail URL: threatinsight.proofpoint.com/…/threat/email/<threatId>)
• Proofpoint Help — People API (top clickers; blocked vs permitted clicks)
• Proofpoint Help — Campaign API
• Proofpoint Help — Forensics API
• Proofpoint Help — URL Decoder API
• TAP Dashboard — threatinsight.proofpoint.com
• Proofpoint Help — Essentials Threat API (same blocked / delivered / click event model on Essentials)
• Proofpoint — Targeted Attack Protection (TAP Threat Insight Dashboard; Attachment Defense; URL Defense; VAP)
• Proofpoint — TAP data sheet (click-time sandbox; Attack Index; Advanced BEC Defense)
• Proofpoint — Threat Response Auto-Pull (TRAP)
• Proofpoint — TRAP data sheet (Smart Search as a retract source; forwards / DL expansion; CLEAR + PhishAlarm)
• Proofpoint — Email Protection
• Proofpoint — Email Fraud Defense (SPF / DKIM / DMARC)
• Proofpoint — Resolving TAP Alerts with TRAP (search / message markers; TAP credentials into TRAP)

Related: Blog 1 · Proofpoint session factory · TAP URL + attachment defense · TRAP lesson · Email fraud / DMARC · Proofpoint practice dashboard