Read Delivered Malicious Messages
Fetch events for messages delivered in the specified time period which contained a known threat.
The events returned for a specified range are based on the time that the event was created, not the time that the event occurred. The time that an event is created is the later of the following:
- The time that the message was sent
- The time that the threat referenced by the message was recognized by Proofpoint
The input fields in this card are dynamically generated based on your instance.
Options
| Field | Definition | Type | Required |
|---|---|---|---|
| Range Type | Choose from available ranges; options are Interval, Since Time, or Since Seconds Ago. |
Dropdown |
TRUE |
Input
| Field | Definition | Type | Required |
|---|---|---|---|
|
timeRange |
|||
| Interval | Time interval to query in ISO 8601 format. The minimum interval allowed is 30 seconds and the maximum interval is 1 hour. |
Date & Time |
TRUE |
| Since Time | Start time of query in ISO 8601 format. The end of the period is the current API server time rounded to the nearest minute. |
Date & Time |
TRUE |
| Since Seconds Ago | Set start time of query to this many seconds before the current API server time (rounded to the nearest minute). |
Number |
TRUE |
Output
| Field | Definition | Type |
|---|---|---|
| Query End Time | Time the period being queried ended. |
Date & Time |
|
Messages |
||
| Spam Score | Message's spam score. |
Number |
| Phish Score | Message's phish score. |
Number |
| Impostor Score | Message's imposter score. |
Number |
| Malware Score | Message's malware score. |
Number |
| Threats Info Map | Array of structures containing details of threats found in the message. | array |
| Sender | Email address of sender; user-part is hashed and domain-part in plaintext. |
Text |
| Recipient | Email addresses of the recipients. |
Text |
| Sender IP | IP address of sender. |
Text |
| Message ID | Non-unique Message-ID extracted from headers of the email message. |
Text |
| Message Time | Time when message was delivered to user or quarantined. |
Date & Time |
| Message Size | Size of message in bytes. |
Number |
| ID | UUID of the event. |
Text |
| QID | Queue ID of the message in PPS. |
Text |
| GUID | Unique ID of message in PPS. |
Text |
| From Address | Email address extracted from the From: header of the message, excluding friendly name. |
Text |
| cc Addresses | List of email addresses from the CC: header, excluding friendly names. |
Text |
| Reply To Addresses | Email address from the Reply-To: header, excluding friendly name. |
Text |
| To Addresses | List of email addresses from the To: header, excluding friendly names. |
Text |
| Header From | Full From: header, including any friendly name. |
Text |
| Header Reply To | Full Reply-To: header (if present), including friendly name. |
Text |
| Completely Rewritten | Rewrite status of message. |
Text |
| Cluster | Name of the PPS cluster that processed the message. |
Text |
| Subject | Subject line of the message. |
Text |
| Quarantine Folder | Name of folder that contains the quarantined message. |
Text |
| Quarantine Rule | Name of rule that quarantined the message. |
Text |