Proofpoint Threat Intelligence

Overview

Proofpoint Threat Intelligence provides contextual information about threat campaigns, threat families, and indicators of compromise (IOCs) observed across the Proofpoint network. This data enriches individual threat events from TAP with broader campaign context, attribution, and forensic evidence. It enables security analysts to understand not just what was blocked, but who is behind the attack and how it fits into a larger campaign.

Proofpoint processes billions of messages daily and correlates threats across its entire customer base, providing unique visibility into large-scale email threat campaigns.

Anti-triggers

• What hit your own tenant — this is Proofpoint's cross-customer intelligence: campaigns, families, and actors observed network-wide. A campaign returned here may never have targeted your organization. Your tenant's own events are proofpoint-tap.
• Evidence artifacts for one message — sandbox reports, pcaps, screenshots, and samples are proofpoint-forensics.
• Another vendor's intelligence feed — Mimecast's near-identically named skill is mimecast-threat-intelligence.

Key Concepts

Campaigns

A campaign is a coordinated set of threat activities sharing common infrastructure, payloads, or techniques. Proofpoint groups related threats into campaigns based on:

• Shared sending infrastructure
• Common payload signatures
• Similar lure themes and social engineering tactics
• Linked command-and-control infrastructure

Threat Families

Family Type	Description	Examples
malware	Named malware families	Emotet, QBot, IcedID, AsyncRAT
phishkit	Phishing kit families	Office365 kit, DocuSign kit
loader	Malware delivery mechanisms	Bumblebee, CactusTorch
rat	Remote access trojans	AsyncRAT, njRAT, DarkComet
ransomware	Ransomware families	LockBit, BlackCat, Cl0p
stealer	Credential/info stealers	FormBook, AgentTesla, RedLine

Threat Actors

Proofpoint tracks named threat actors (e.g., TA505, TA542, TA577) that conduct persistent email-based campaigns. Actor profiles include:

• Known TTPs (tactics, techniques, procedures)
• Associated malware families
• Targeted industries and geographies
• Campaign frequency and sophistication level

Indicators of Compromise (IOCs)

IOC Type	Description	Example
url	Malicious URL	https://evil-domain.com/payload
domain	Malicious domain	evil-domain.com
ip	Malicious IP address	192.168.1.100
hash_md5	MD5 file hash	d41d8cd98f00b204e9800998ecf8427e
hash_sha256	SHA256 file hash	e3b0c44298fc1c149afbf4c8996fb92427ae41e4...
sender	Malicious sender address	attacker@spoofed-domain.com
subject	Lure subject line pattern	Invoice #[0-9]{6}

Field Reference

Campaign Fields

Field	Type	Description
campaignId	string	Unique campaign identifier
name	string	Proofpoint-assigned campaign name
description	string	Campaign summary and context
startDate	datetime	First observed activity
lastActivity	datetime	Most recent activity
actors	object[]	Associated threat actors
families	object[]	Associated malware/threat families
techniques	string[]	MITRE ATT&CK techniques observed
malwareCount	int	Number of unique malware samples
messageCount	int	Total messages in the campaign
recipientCount	int	Number of targeted recipients
industries	string[]	Targeted industry verticals

Threat Indicator Fields

Field	Type	Description
id	string	Unique indicator identifier
type	string	IOC type (url, domain, ip, hash)
value	string	The indicator value
firstSeen	datetime	First observation time
lastSeen	datetime	Most recent observation
threatStatus	string	active, cleared, falsePositive
campaigns	string[]	Associated campaign IDs
families	string[]	Associated threat families
confidence	int	0-100 confidence score
severity	string	critical, high, medium, low, info

MCP Tools

Tool	Description	Key Parameters
proofpoint_threat_get_campaign	Campaign detail by ID — actors, malware families, techniques, associated messages	campaign_id (required)
proofpoint_threat_get_by_id	Threat detail by ID — type, classification, associated indicators	threat_id (required)
proofpoint_threat_get_iocs	Indicators of compromise for a campaign or time range — URLs, IPs, domains, hashes	campaign_id, sinceTime, interval, threat_type
proofpoint_threat_list_families	Malware families Proofpoint tracks, with descriptions and associated campaigns	sinceTime, interval
proofpoint_reports_threat_summary	Threat breakdown by type with counts and trends	window, threatType

Not available through this plugin

Everything here is a forward lookup: you arrive with an ID or a time window and get intelligence back. There is no way to arrive with a name or an indicator and search.

• Searching campaigns by criteria (actor, family, date). Campaign access is by ID only, and the IDs come from TAP events.
• Reverse IOC lookup — "which campaigns contain this hash". proofpoint_threat_get_iocs runs the other direction: campaign or time window in, indicators out. To answer an inbound IOC question, pull the IOC set for the window and match locally.
• Per-family or per-actor detail pages. proofpoint_threat_list_families lists families; there is no get-by-name. Actor names appear inside campaign output and have no tool of their own.

Common Workflows

Investigate a Campaign from TAP Event

1. From a TAP event, extract the campaign_id
2. Call proofpoint_threat_get_campaign with the campaign ID
3. Review the campaign description, actor attribution, and techniques
4. Call proofpoint_threat_get_iocs with the same campaign_id to get all IOCs for the campaign
5. Export IOCs to your SIEM or firewall blocklists
6. Check if other users in the organization were targeted by the same campaign

Track a Threat Family

1. Call proofpoint_threat_list_families for the window you care about and find the family (e.g. Emotet) in the returned list — there is no get-by-name
2. Review the campaigns the listing associates with it
3. Call proofpoint_threat_get_campaign for each of those campaign IDs
4. Assess whether the family is actively targeting your organization
5. Review MITRE ATT&CK techniques to inform detection rules

IOC Lookup

An inbound IOC — someone hands you a hash or a URL and asks "have we seen this?" — cannot be looked up directly. There is no indicator-keyed search. The workable approximation:

1. Call proofpoint_threat_get_iocs for the time window in question, optionally narrowed by threat_type
2. Match the indicator against the returned set yourself
3. If it matches, call proofpoint_threat_get_campaign on the associated campaign for context
4. A non-match means "not in the window you pulled", not "never seen" — say so, rather than reporting a clean result

Threat Landscape Review

1. Call proofpoint_reports_threat_summary with a 30-day window
2. Review the breakdown by threat type with counts and trends
3. Add proofpoint_threat_list_families for the same window to see which families are active
4. Cross-reference with your organization's TAP data
5. Update security awareness training based on active campaigns

Correlate Across Multiple Events

1. Gather threat_id values from multiple TAP events
2. For each, call proofpoint_threat_get_by_id for classification and its associated indicators
3. Look for shared infrastructure (common domains, IPs, C2 servers)
4. If shared infrastructure is found, these events may be part of the same campaign
5. Confirm by calling proofpoint_threat_get_campaign on the campaign IDs the threats carry — you cannot search campaigns to find the link, only confirm one you already have

Error Handling

Common API Errors

Code	Message	Resolution
400	Invalid campaign ID	Verify the campaign ID format from the TAP event
400	Invalid date range	Ensure dates are within the allowed range
401	Authentication failed	Verify service principal and secret
403	Threat intelligence access not enabled	Ensure your license includes threat intelligence API
404	Campaign not found	The campaign may be too old or not yet correlated
404	Threat family not found	Verify the family name spelling
429	Rate limit exceeded	Implement backoff; intel API is rate-limited

No Results

• Campaign data may take time to correlate - retry after a few hours
• Some threats may not be attributed to a named campaign
• IOC searches may return no results if the indicator is new or unique to your organization
• Older campaigns may be archived and unavailable via the API

Best Practices

1. Start with TAP events - Use campaign IDs from TAP events as entry points into threat intelligence
2. Export IOCs to blocklists - Feed campaign IOCs into your firewall, proxy, and EDR blocklists
3. Track actor patterns - Named actors have consistent TTPs; use this to predict future attacks
4. Correlate with external intel - Cross-reference Proofpoint intelligence with other threat feeds
5. Update detection rules - Use MITRE ATT&CK techniques from campaigns to tune detection
6. Brief your team - Share campaign summaries with your security team for situational awareness
7. Monitor active families - Track threat families that target your industry vertical
8. Use confidence scores - Prioritize high-confidence IOCs for automated blocking

Related Skills

• Proofpoint TAP - Threat events and click tracking
• Proofpoint Forensics - Deep threat investigation
• Proofpoint People - Identify targeted users
• Proofpoint API Patterns - Authentication and rate limits