proofpoint

View recent TAP threat events including blocked messages, delivered threats, and click activity

Decode a Proofpoint URL Defense rewritten URL back to the original URL

Deep-dive threat investigation with forensics, campaign context, and remediation options

Release one or more quarantined messages to their intended recipients

Search quarantined messages in Proofpoint by sender, recipient, subject, or reason

Use this agent when auditing email security posture across Proofpoint-protected organizations, investigating threats via TAP intelligence, tracing specific emails, analyzing Very Attacked Persons (VAPs), or generating per-org security reports for MSP clients. Trigger for: Proofpoint threat investigation, TAP threat data, SIEM click events, proofpoint phishing, email security audit Proofpoint, Very Attacked Persons, VAP analysis, proofpoint message trace, blocked email Proofpoint, campaign intelligence. Examples: "Pull today's Proofpoint TAP threat data for the fleet", "Which users clicked on permitted phishing URLs this week?", "An email isn't arriving for our Proofpoint client — trace it", "Generate the monthly email security report for all Proofpoint orgs"

Use this agent when analyzing Very Attacked Persons (VAPs) in Proofpoint — tracking executives and high-value targets who receive the most sophisticated or highest-volume attacks, surfacing patterns over time, and recommending enhanced protections for the highest-risk users across the MSP client portfolio. Trigger for: VAP analysis, Very Attacked Person, Proofpoint VAP, high-value targets email, most targeted users, executive targeting, VIP email protection, Proofpoint targeted users, high-risk users Proofpoint, email attack concentration, VAP report, user threat exposure. Examples: "Who are our most attacked users across all Proofpoint clients this month?", "Generate a VAP report for the executive team at Acme Corp", "Which CFOs in our portfolio are receiving the most sophisticated attacks?", "Identify the highest-risk users in Proofpoint and recommend enhanced protections"

Use this skill when working with the Proofpoint API - authentication using HTTP Basic Auth with service principal and secret, base URLs, rate limits, pagination, error codes, and common integration patterns. Covers TAP SIEM API, quarantine API, people API, and URL Defense API authentication and usage patterns.

Use this skill when working with Proofpoint forensics and threat response - auto-pull, search and destroy, message trace, evidence collection, and remediation workflows. Covers post-delivery remediation, message investigation, and incident response procedures for email-borne threats.

Use this skill when working with Proofpoint people-centric security - Very Attacked People (VAP) reports, top clickers, user risk scoring, attack index, and user-level threat analytics. Covers identifying high-risk users, measuring user susceptibility, and implementing targeted security controls for the most attacked people.

Use this skill when working with Proofpoint email quarantine - listing, searching, releasing, and deleting quarantined messages. Covers quarantine reasons, sender and recipient filtering, bulk operations, quarantine folders, and message preview. Essential for MSP help desk teams managing quarantined email for clients.

Use this skill when working with Proofpoint Targeted Attack Protection (TAP) - retrieving threat events, click tracking, message delivery and blocking data, SIEM integration feeds, and threat type analysis. Covers URL threats, attachment threats, message-level threats, permitted and blocked clicks, and campaign correlation. Essential for MSP security analysts monitoring email threat activity.