/tap

name: "Proofpoint TAP"
description: >
  Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across
  URL, attachment, and message-level vectors, click tracking, message disposition,
  SIEM integration feeds, and campaign correlation.
when_to_use: >-
  When retrieving TAP threat events, click activity, message delivery/blocking data, or SIEM
  feeds. Use when: proofpoint tap, targeted attack protection, proofpoint threats, email threats,
  tap events, proofpoint clicks, click tracking, proofpoint messages, message blocked, message
  delivered, proofpoint siem, tap api, threat events, proofpoint malware, or proofpoint
  phishing.

Proofpoint Targeted Attack Protection (TAP)

Overview

Proofpoint TAP is the core threat detection engine in the Proofpoint email security stack. It analyzes email messages, URLs, and attachments in real time using sandboxing, behavioral analysis, and threat intelligence. The TAP SIEM API provides programmatic access to all threat events, click activity, and message disposition data.

TAP identifies three primary threat vectors:

• **URL threats** - Malicious links in email bodies
• **Attachment threats** - Malicious files attached to messages
• **Message-level threats** - Threats classified at the message level (e.g., BEC, impostor)

Anti-triggers

• **Anything older than 24 hours** — the SIEM API's maximum lookback is

24 hours and it answers an out-of-range window with an empty result, not an error. "Did we see this last week?" needs `proofpoint-forensics` for a specific message or `proofpoint-threat-intel` for a campaign.

• **Acting on a message** — TAP is a read-only event feed. Release and

delete are `proofpoint-quarantine`; removing delivered mail is `proofpoint-forensics`.

• **Which people are most targeted** — TAP returns per-event rows; the

per-user rollup, Attack Index, and VAP list are `proofpoint-people`.

• **Another vendor's threat events** — Checkpoint Harmony is

`avanan-threats`, Abnormal is `abnormal-security-threats`, and Mimecast message-level delivery tracking is `mimecast-message-tracking`.

• **A rewritten link and what happened when it was clicked** — URL

Defense rewriting, click verdicts, and decoding a `urldefense.proofpoint.com` target are `proofpoint-url-defense`; TAP reports the click event without explaining the rewrite.

Key Concepts

Threat Classifications

| Classification | Description | Typical Action | |---------------|-------------|----------------| | `malware` | Known or sandboxed malware payload | Block and quarantine | | `phish` | Credential harvesting or phishing | Block and quarantine | | `spam` | Unsolicited bulk email | Quarantine or tag | | `impostor` | Business Email Compromise (BEC) | Quarantine or warn |

Threat Dispositions

| Disposition | Description | |-------------|-------------| | `allowed` | Message was delivered to the recipient | | `blocked` | Message was blocked before delivery | | `quarantined` | Message was placed in quarantine |

Click Verdicts

| Verdict | Description | |---------|-------------| | `permitted` | Click was allowed (URL was clean at time of click) | | `blocked` | Click was blocked (URL was malicious at time of click) |

Time Windows

TAP SIEM API supports relative and absolute time windows:

| Parameter | Format | Example | Max Window | |-----------|--------|---------|------------| | `sinceSeconds` | Integer (seconds) | `3600` (1 hour) | 86400 (24 hours) | | `sinceTime` | ISO 8601 | `2024-02-15T00:00:00Z` | 24 hours from now | | `interval` | ISO 8601 duration | `PT1H` (1 hour) | 1 hour |

**Important:** The maximum lookback window is 24 hours. For historical data beyond 24 hours, use the forensics or campaign APIs instead.

Field Reference

Message Event Fields

| Field | Type | Description | |-------|------|-------------| | `GUID` | string | Unique message identifier | | `QID` | string | Queue ID from the mail server | | `sender` | string | Envelope sender address | | `recipient` | string[] | List of recipient addresses | | `subject` | string | Message subject line | | `messageTime` | datetime | When the message was processed | | `threatsInfoMap` | object[] | Array of threat details | | `malwareScore` | int | 0-100 malware confidence score | | `phishScore` | int | 0-100 phishing confidence score | | `spamScore` | int | 0-100 spam confidence score | | `impostorScore` | int | 0-100 impostor/BEC confidence score | | `cluster` | string | Proofpoint cluster that processed the message | | `messageParts` | object[] | Breakdown of message MIME parts | | `completelyRewritten` | boolean | Whether all URLs were rewritten by URL Defense | | `policyRoutes` | string[] | Policy rules that matched |

Threat Info Map Fields

| Field | Type | Description | |-------|------|-------------| | `threat` | string | The threat indicator (URL, hash, etc.) | | `threatID` | string | Unique threat identifier | | `threatStatus` | string | `active`, `cleared`, `falsePositive` | | `threatTime` | datetime | When the threat was first identified | | `threatType` | string | `url`, `attachment`, `messageText` | | `classification` | string | `malware`, `phish`, `spam`, `impostor` | | `threatUrl` | string | URL to threat detail in TAP dashboard |

Click Event Fields

| Field | Type | Description | |-------|------|-------------| | `campaignId` | string | Associated campaign identifier | | `clickIP` | string | IP address of the clicker | | `clickTime` | datetime | When the click occurred | | `GUID` | string | Message GUID containing the URL | | `recipient` | string | Who clicked | | `sender` | string | Who sent the message | | `threatID` | string | Threat identifier for the URL | | `threatTime` | datetime | When URL was classified as threat | | `threatURL` | string | The malicious URL that was clicked | | `url` | string | The original URL before rewrite | | `userAgent` | string | Browser user agent of the clicker | | `classification` | st