Read Compromised User

Get users which were most attacked during a specified period in their organizations.

Required fields are indicated in red.

Unless otherwise mentioned, all fields are text.


  • Window (dropdown): choose from available time windows


  • Total VAP Users (number): number of Very Attacked Persons (VAPs)

  • Interval: time interval in ISO 8601 format that the response was calculated for

  • Average Attack Index (number): average attack index value

  • VAP Attack Index Threshold (number): attack index threshold for this interval; users above this threshold are considered to be VAPs

  • Users: an array of User objects

    • Identity (object)

      • GUID: unique Proofpoint identifier

      • Customer User ID: identifier associated with the user that was provided by customer

      • Emails (object): list of email addresses associated with user

      • Name: user's name

      • Department: user's department

      • Location: user's location

      • Title: user's title

      • VIP (true/false): 'true' if user is considered to be a VIP

    • Threat Statistics (object)

      • Attack Index: user's attack index value for the specified period

      • Families (object): a collection of threat families, with each entry containing the name and threat score for that family