Read Compromised User

Get users which were most attacked during a specified period in their organizations.


Field Definition Type Required
Window Choose from available time windows. Dropdown TRUE


Field Definition Type
Total VAP Users Number of Very Attacked Persons (VAPs). Number
Interval Time interval in ISO 8601 format that the response was calculated for. String
Average Attack Index Average attack index value. Number
VAP Attack Index Threshold Attack index threshold for this interval; users above this threshold are considered to be VAPs. Number
Users - Identity
GUID Unique Proofpoint identifier. String
Customer User ID Identifier associated with the user that was provided by customer. String
Emails List of email addresses associated with user. Object
Name User's name. String
Department User's department. String
Location User's location. String
Title User's title. String
VIP true if user is considered to be a VIP. Boolean

Users - Threat Statistics

Attack Index User's attack index value for the specified period. String
Families A collection of threat families, with each entry containing the name and threat score for that family. Object

Related topics

Proofpoint connector

About the elements of Okta Workflows

Proofpoint API documentation