/forensics

name: "Proofpoint Forensics"
description: >
  Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and
  search-and-destroy remediation actions, evidence collection, message trace, and
  post-delivery incident response workflows for email-borne threats.
when_to_use: >-
  When investigating or remediating email-borne threats after delivery using Proofpoint forensics
  or TRAP. Use when: proofpoint forensics, proofpoint search and destroy, proofpoint auto-pull,
  email forensics, message investigation, proofpoint remediation, threat response, email incident
  response, message trace, proofpoint trap, proofpoint evidence, or post-delivery remediation.

Proofpoint Forensics & Threat Response

Overview

Proofpoint Forensics provides deep investigation capabilities for email-borne threats. When a threat is detected after delivery, Proofpoint Threat Response Auto-Pull (TRAP) can automatically or manually remediate messages that have already reached user mailboxes. This skill covers evidence collection, message investigation, search and destroy operations, and incident response workflows.

TRAP integrates with Microsoft 365 and Google Workspace to move or delete messages from user mailboxes after delivery, closing the gap between detection and remediation.

Anti-triggers

• **Stopping a message before it is delivered** — everything here acts

after delivery. Releasing or deleting mail still held pre-delivery is `proofpoint-quarantine`.

• **The threat event that prompted the investigation** — GUIDs,

dispositions, scores, and click records come from `proofpoint-tap`; this skill starts once you already have a GUID or threat ID.

• **Campaign attribution, actor names, and IOC context** — use

`proofpoint-threat-intel`.

• **"Search and destroy" on endpoints rather than mailboxes** — TRAP

reaches Microsoft 365 and Google Workspace mailboxes only. Killing processes or removing persistence on a host is `huntress-incidents`.

Key Concepts

Remediation is a two-step sequence, not one call

The single most important thing to know about this domain: **finding messages and removing them are separate tools.**

1. `proofpoint_forensics_search_messages` — read-only. Takes criteria (`sender`, `subject`, `message_id`, `threat_id`, `startDate`, `endDate`) and returns matching delivered messages. Changes nothing. 2. `proofpoint_forensics_pull_messages` — destructive. Takes `message_ids` (an explicit array) plus a `reason` string for the audit trail, and removes those messages from mailboxes.

The scope of the destructive step is therefore fixed and inspectable *before* you call it. Always look at the ID list the search returned, and its length, before passing it on. Piping step 1 straight into step 2 without reading the result is how an over-broad criterion ("subject contains Invoice") turns into hundreds of deleted legitimate messages.

Remediation actions are a tenant setting, not a parameter

Proofpoint TRAP can move a pulled message to junk, soft-delete it, hard-delete it, or quarantine it. **None of these is selectable through this plugin** — `proofpoint_forensics_pull_messages` exposes no action argument, so what "pull" does is whatever the tenant's TRAP policy says. Do not promise a user that a removal is recoverable; check the tenant's configuration in the Proofpoint console, because no tool here reports it.

Evidence types

`proofpoint_forensics_get_threat` returns forensic evidence for one threat, and `proofpoint_forensics_get_campaign` returns it aggregated across a campaign. Depending on what the tenant's analysis produced, the response may contain any of:

| Type | Contents | |------|----------| | `screenshot` | PNG of the rendered threat page or attachment | | `pcap` | Full packet capture from sandbox detonation | | `sample` | The original malicious file | | `headers` | Full RFC 822 headers | | `urls` | All URLs found in the message | | `attachments` | File names, hashes, sizes | | `sandbox_report` | Behavioural analysis results |

These are response contents, not arguments — there is no per-type fetch. `sample` and `pcap` are live malware; pulling one into the session is read-tier by blast radius and handled-as-malware by common sense.

Field Reference

Forensic Report Fields

| Field | Type | Description | |-------|------|-------------| | `id` | string | Unique forensic report identifier | | `GUID` | string | Message GUID (links to TAP events) | | `scope` | string | `online` (cloud analysis) or `sandbox` (detonation) | | `type` | string | Type of forensic evidence | | `name` | string | Display name for the evidence | | `threatTime` | datetime | When the threat was classified | | `engineResults` | object[] | Results from analysis engines | | `platforms` | object[] | Platforms where evidence was collected |

Engine Result Fields

| Field | Type | Description | |-------|------|-------------| | `engine` | string | Analysis engine name | | `verdict` | string | `malicious`, `suspicious`, `benign` | | `score` | int | Confidence score (0-100) | | `details` | string | Detailed analysis findings | | `iocs` | object[] | IOCs extracted by this engine |

Message Trace Fields

| Field | Type | Description | |-------|------|-------------| | `GUID` | string | Message GUID | | `messageId` | string | RFC 822 Message-ID header | | `sender` | string | Envelope sender | | `recipients` | string[] | All recipients | | `subject` | string | Message subject | | `receivedTime` | datetime | When Proofpoint received the message | | `deliveryTime` | datetime | When delivered to mailbox | | `disposition` | string | Final message disposition | | `policyActions` | string[] | Policy actions applied | | `routingPath` | string[] | Mail routing hops |

MCP Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | `proofpoint_forensics_get_threat` | Forensic evidence for one threat — behavioural analysis, network act