Proofpoint TAP Integration - XQL Query Help

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Proofpoint TAP Integration - XQL Query Help

L1 Bithead

Has anyone worked with PP TAP integration and creating any useful XQL queries to help identify potential malicious mail that a user interacts with?  As example:
Email was not determined "bad" initially but after some sandbox from PP, it is later classified as "bad" and is blocked.  Before that scenario took place, there is potential for one or more users who clicked on the "bad link" from the email.  Is there any way to surface that via XQL query since we're ingesting those logs from PP?


L0 Member


While I don't have specific experience with PP TAP integration and XQL queries, it's theoretically possible to identify potential malicious emails that users interacted with by analyzing the logs from PP TAP. One approach could involve creating XQL queries to search for patterns or indicators of malicious activity, such as URLs or domains associated with known threats. You could also look for anomalies in email behavior, such as a mass general patient portal sudden increase in email clicks or interactions with suspicious content. Additionally, leveraging PP TAP's sandboxing data to correlate email interactions with later determinations of maliciousness could help identify potentially compromised emails. However, implementing such queries would depend on the specific logging capabilities and data schema provided by PP TAP, as well as your organization's policies and requirements for detecting and mitigating email threats. Consulting with security experts or leveraging community resources for XQL query examples related to email security may also be beneficial in this context.

Thanks for the response.  All makes sense.  I guess I was hoping I might find some example XQL queries that others have used with the Proofpoint TAP log integration to get me started in the proper direction.   Perhaps I will just dig more and have to experiment with those logs to see what may (may not) be useful in surfacing evidence in the example scenario in original post.


  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!