/threat-intel

name: "Proofpoint Threat Intelligence"
description: >
  Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families
  and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches
  individual TAP threat events.
when_to_use: >-
  When investigating threat campaigns, threat families, actors, or IOCs, or correlating TAP events
  with broader context. Use when: proofpoint threat intelligence, proofpoint campaign, threat
  campaign, proofpoint ioc, indicators of compromise, threat family, proofpoint threat, threat
  actor, proofpoint intel, campaign tracking, threat indicator, or proofpoint malware family.

Proofpoint Threat Intelligence

Overview

Proofpoint Threat Intelligence provides contextual information about threat campaigns, threat families, and indicators of compromise (IOCs) observed across the Proofpoint network. This data enriches individual threat events from TAP with broader campaign context, attribution, and forensic evidence. It enables security analysts to understand not just what was blocked, but who is behind the attack and how it fits into a larger campaign.

Proofpoint processes billions of messages daily and correlates threats across its entire customer base, providing unique visibility into large-scale email threat campaigns.

Anti-triggers

• **What hit your own tenant** — this is Proofpoint's cross-customer

intelligence: campaigns, families, and actors observed network-wide. A campaign returned here may never have targeted your organization. Your tenant's own events are `proofpoint-tap`.

• **Evidence artifacts for one message** — sandbox reports, pcaps,

screenshots, and samples are `proofpoint-forensics`.

• **Another vendor's intelligence feed** — Mimecast's near-identically

named skill is `mimecast-threat-intelligence`.

Key Concepts

Campaigns

A campaign is a coordinated set of threat activities sharing common infrastructure, payloads, or techniques. Proofpoint groups related threats into campaigns based on:

• Shared sending infrastructure
• Common payload signatures
• Similar lure themes and social engineering tactics
• Linked command-and-control infrastructure

Threat Families

| Family Type | Description | Examples | |-------------|-------------|---------| | `malware` | Named malware families | Emotet, QBot, IcedID, AsyncRAT | | `phishkit` | Phishing kit families | Office365 kit, DocuSign kit | | `loader` | Malware delivery mechanisms | Bumblebee, CactusTorch | | `rat` | Remote access trojans | AsyncRAT, njRAT, DarkComet | | `ransomware` | Ransomware families | LockBit, BlackCat, Cl0p | | `stealer` | Credential/info stealers | FormBook, AgentTesla, RedLine |

Threat Actors

Proofpoint tracks named threat actors (e.g., TA505, TA542, TA577) that conduct persistent email-based campaigns. Actor profiles include:

• Known TTPs (tactics, techniques, procedures)
• Associated malware families
• Targeted industries and geographies
• Campaign frequency and sophistication level

Indicators of Compromise (IOCs)

| IOC Type | Description | Example | |----------|-------------|---------| | `url` | Malicious URL | `https://evil-domain.com/payload` | | `domain` | Malicious domain | `evil-domain.com` | | `ip` | Malicious IP address | `192.168.1.100` | | `hash_md5` | MD5 file hash | `d41d8cd98f00b204e9800998ecf8427e` | | `hash_sha256` | SHA256 file hash | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4...` | | `sender` | Malicious sender address | `attacker@spoofed-domain.com` | | `subject` | Lure subject line pattern | `Invoice #[0-9]{6}` |

Field Reference

Campaign Fields

| Field | Type | Description | |-------|------|-------------| | `campaignId` | string | Unique campaign identifier | | `name` | string | Proofpoint-assigned campaign name | | `description` | string | Campaign summary and context | | `startDate` | datetime | First observed activity | | `lastActivity` | datetime | Most recent activity | | `actors` | object[] | Associated threat actors | | `families` | object[] | Associated malware/threat families | | `techniques` | string[] | MITRE ATT&CK techniques observed | | `malwareCount` | int | Number of unique malware samples | | `messageCount` | int | Total messages in the campaign | | `recipientCount` | int | Number of targeted recipients | | `industries` | string[] | Targeted industry verticals |

Threat Indicator Fields

| Field | Type | Description | |-------|------|-------------| | `id` | string | Unique indicator identifier | | `type` | string | IOC type (url, domain, ip, hash) | | `value` | string | The indicator value | | `firstSeen` | datetime | First observation time | | `lastSeen` | datetime | Most recent observation | | `threatStatus` | string | `active`, `cleared`, `falsePositive` | | `campaigns` | string[] | Associated campaign IDs | | `families` | string[] | Associated threat families | | `confidence` | int | 0-100 confidence score | | `severity` | string | `critical`, `high`, `medium`, `low`, `info` |

MCP Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | `proofpoint_threat_get_campaign` | Campaign detail by ID — actors, malware families, techniques, associated messages | `campaign_id` (required) | | `proofpoint_threat_get_by_id` | Threat detail by ID — type, classification, associated indicators | `threat_id` (required) | | `proofpoint_threat_get_iocs` | Indicators of compromise for a campaign or time range — URLs, IPs, domains, hashes | `campaign_id`, `sinceTime`, `interval`, `threat_type` | | `proofpoint_threat_list_families` | Malware families Proofpoint tracks, with descriptions and associated campaigns | `sinceTime`, `interval` | | `proofpoint_reports_threat_summary` | Threat breakdown by type with counts and trends | `window`, `threatType` |

Not available through this plugin

Everything here is a **forward lookup**: you arrive with an ID or a time window and get intelligence back. There is no way to arrive with a