Skip to main content

List Delivered Messages

List events of delivered messages which contained a known threat.

External Documentation

To learn more, visit the Proofpoint TAP documentation.

Basic Parameters​

ParameterDescription
Starting TimeThe starting time of the search interval. End time is the current server time.
Threat StatusReturns only chosen threat status.
Threat TypeReturns only chosen threat types.

Advanced Parameters​

ParameterDescription
IntervalThe interval of the events returned. Maximum interval is 1 hour. For example: 2016-05-01T12:00:00Z/2016-05-01T13:00:00Z.
Seconds SinceThe size of the search interval in seconds starting from the current server time. Valid range: 30-3600

Example Output​

{
    "messagesDelivered": [
        {
            "GUID": "c26dbea0-80d5-463b-b93c-4e8b708219ce",
            "QID": "r2FNwRHF004109",
            "ccAddresses": [
                "bruce.wayne@university-of-education.zz"
            ],
            "clusterId": "pharmtech_hosted",
            "completelyRewritten": "true",
            "fromAddress": "badguy@evil.zz",
            "headerCC": "\"Bruce Wayne\" <bruce.wayne@university-of-education.zz>",
            "headerFrom": "\"A. Badguy\" <badguy@evil.zz>",
            "headerReplyTo": null,
            "headerTo": "\"Clark Kent\" <clark.kent@pharmtech.zz>; \"Diana Prince\" <diana.prince@pharmtech.zz>",
            "impostorScore": 0,
            "malwareScore": 100,
            "messageID": "20160624211145.62086.mail@evil.zz",
            "messageParts": [
                {
                    "contentType": "text/plain",
                    "disposition": "inline",
                    "filename": "text.txt",
                    "md5": "008c5926ca861023c1d2a36653fd88e2",
                    "oContentType": "text/plain",
                    "sandboxStatus": "unsupported",
                    "sha256": "85738f8f9a7f1b04b5329c590ebcb9e425925c6d0984089c43a022de4f19c281"
                },
                {
                    "contentType": "application/pdf",
                    "disposition": "attached",
                    "filename": "Invoice for Pharmtech.pdf",
                    "md5": "5873c7d37608e0d49bcaa6f32b6c731f",
                    "oContentType": "application/pdf",
                    "sandboxStatus": "threat",
                    "sha256": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca"
                }
            ],
            "messageTime": "2016-06-24T21:18:38.000Z",
            "modulesRun": [
                "pdr",
                "sandbox",
                "spam",
                "urldefense"
            ],
            "phishScore": 46,
            "policyRoutes": [
                "default_inbound",
                "executives"
            ],
            "quarantineFolder": "Attachment Defense",
            "quarantineRule": "module.sandbox.threat",
            "recipient": [
                "clark.kent@pharmtech.zz",
                "diana.prince@pharmtech.zz"
            ],
            "replyToAddress": null,
            "sender": "e99d7ed5580193f36a51f597bc2c0210@evil.zz",
            "senderIP": "192.0.2.255",
            "spamScore": 4,
            "subject": "Please find a totally safe invoice attached.",
            "threatsInfoMap": [
                {
                    "campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
                    "classification": "MALWARE",
                    "threat": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca",
                    "threatId": "2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca",
                    "threatStatus": "active",
                    "threatTime": "2016-06-24T21:18:38.000Z",
                    "threatType": "ATTACHMENT",
                    "threatUrl": "https://threatinsight.proofpoint.com/#/73aa0499-dfc8-75eb-1de8-a471b24a2e75/threat/u/2fab740f143fc1aa4c1cd0146d334c5593b1428f6d062b2c406e5efe8abe95ca"
                },
                {
                    "campaignId": "46e01b8a-c899-404d-bcd9-189bb393d1a7",
                    "classification": "MALWARE",
                    "threat": "badsite.zz",
                    "threatId": "3ba97fc852c66a7ba761450edfdfb9f4ffab74715b591294f78b5e37a76481aa",
                    "threatTime": "2016-06-24T21:18:07.000Z",
                    "threatType": "URL",
                    "threatUrl": "https://threatinsight.proofpoint.com/#/73aa0499-dfc8-75eb-1de8-a471b24a2e75/threat/u/3ba97fc852c66a7ba761450edfdfb9f4ffab74715b591294f78b5e37a76481aa"
                }
            ],
            "toAddresses": [
                "clark.kent@pharmtech.zz",
                "diana.prince@pharmtech.zz"
            ]
        }
    ],
    "messagesBlocked": [],
    "clicksPermitted": [],
    "clicksBlocked": [],
    "queryEndTime": "2024-03-25T20:25:00Z"
}

Workflow Library Example​

List Delivered Messages with Proofpoint Tap and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop