Read Compromised User

Get users which were most attacked during a specified period in their organizations.


Field Definition Type Required
Window Choose from available time windows. Dropdown TRUE


Field Definition Type
Total VAP Users Number of Very Attacked Persons (VAPs). Number
Interval Time interval in ISO 8601 format that the response was calculated for. String
Average Attack Index Average attack index value. Number
VAP Attack Index Threshold Attack index threshold for this interval; users above this threshold are considered to be VAPs. Number
Users - Identity
GUID Unique Proofpoint identifier. String
Customer User ID Identifier associated with the user that was provided by customer. String
Emails List of email addresses associated with user. Object

Name of the user.

Department User's department. String
Location User's location. String

Job title of the user.

VIP true if user is considered to be a VIP. Boolean
Users - Threat Statistics
Attack Index User's attack index value for the specified period. String
Families A collection of threat families, with each entry containing the name and threat score for that family. Object

Related topics

Proofpoint connector

Workflow elements

Proofpoint API documentation