proofpoint

Plugin proofpoint from marketplace msp-claude-plugins in WYRE-AI/msp-claude-plugins. Commands read from the repo's manifest — yesterday.

Skills (7)

• Proofpoint API Patterns

  Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling. When authenticating to or calling any Proofpoint API (TAP SIEM, quarant

• Proofpoint Forensics

  Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats. When investigating or remediating email-borne threats after delivery using Pr

• Proofpoint People

  Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP) reports, attack index scoring, click susceptibility, top clickers, and user risk categorization for targeting security controls and training. When identifying high-risk or heavily targeted users, analyzing click behavior, or

• Proofpoint Quarantine

  Proofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine. When listing, searching, releasing, or deleting quarantined messages in Proofpoint. Use when: proofpoint quarantine

• Proofpoint TAP

  Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across URL, attachment, and message-level vectors, click tracking, message disposition, SIEM integration feeds, and campaign correlation. When retrieving TAP threat events, click activity, message delivery/blocking data, or SIEM

• Proofpoint Threat Intelligence

  Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events. When investigating threat campaigns, threat families, actors, or IOCs, or correlating TAP events with broader

• Proofpoint URL Defense

  Proofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals. When working with URL rewriting, decoding, click-time protection, or investigating rewritten or clicked URLs in Proofpoint URL Defe

Slash commands (6)

• /proofpoint:check-threats

  View recent TAP threat events including blocked messages, delivered threats, and click activity

• /proofpoint:decode-url

  Decode a Proofpoint URL Defense rewritten URL back to the original URL

• /proofpoint:investigate-threat

  Deep-dive threat investigation with forensics, campaign context, and remediation options

• /proofpoint:release-quarantine

  Release one or more quarantined messages to their intended recipients

• /proofpoint:search-quarantine

  Search quarantined messages in Proofpoint by sender, recipient, subject, or reason

• /proofpoint:vap-report

  Get the Very Attacked People (VAP) report showing the most targeted users

Subagents (2)

• email-security-auditor

  Use this agent when auditing email security posture across Proofpoint-protected organizations, investigating threats via TAP intelligence, tracing specific emails, analyzing Very Attacked Persons (VAPs), or generating per-org security reports for MSP clients. Trigger for: Proofpoint threat investiga

• vap-reporter

  Use this agent when analyzing Very Attacked Persons (VAPs) in Proofpoint — tracking executives and high-value targets who receive the most sophisticated or highest-volume attacks, surfacing patterns over time, and recommending enhanced protections for the highest-risk users across the MSP client por

Similar plugins