To learn more, visit the Proofpoint Threat Response Auto Pull documentation.

​
Parameters​

ParameterDescription
Alert IDThe ID value of alert to retrieve.

​
Example Output​

{    "id": 3,    "severity": "Info",    "source": "Abuse Mailbox Monitor",    "state": "Linked",    "attackDirection": "inbound",    "received": "2019-02-25T17:22:48Z",    "emails": [        {            "sender": {                "email": "analyzer@analyzer.featbot.io"            },            "recipient": {                "email": "x-abuse@acme.com"            },            "subject": "FW: Report me!",            "messageId": "<BE095FD07C20C5419BF398E428D3AAD416664E78@orion-exch.orion.local>",            "body": "<html dir=\"ltr\">DELETED</html>",            "bodyType": "html",            "headers": {                "Thread-Index": "AdTNIeEpSJX5TD0eRy+DKCAGay+zzgAABtQOAAAiV44AAwUbrg==",                "Received": "from ORION-EXCH.orion.local ([::1]) by orion-exch.orion.local ([::1]) with mapi id 14.03.0123.003; Mon, 25 Feb 2019 09:21:59 -0800",                "X-MS-TNEF-Correlator": "<BE095FD07C20C5419BF398E428D3AAD416664E78@orion-exch.orion.local>",                "Thread-Topic": "Report me!",                "Message-ID": "<BE095FD07C20C5419BF398E428D3AAD416664E78@orion-exch.orion.local>",                "Content-Transfer-Encoding": "binary",                "X-MS-Exchange-Organization-AuthAs": "Internal",                "In-Reply-To": "<BE095FD07C20C5419BF398E428D3AAD416664E63@orion-exch.orion.local>",                "X-MS-Exchange-Organization-AuthSource": "orion-exch.orion.local",                "Subject": "FW: Report me!",                "MIME-Version": "1.0",                "Date": "Mon, 25 Feb 2019 09:21:58 -0800",                "X-MS-Exchange-Organization-AuthMechanism": "04",                "X-MS-Exchange-Organization-SCL": "-1",                "References": "<F4F06DB4324F7649A88EA3C014334523166CE43E@orion-exch.orion.local>,<BE095FD07C20C5419BF398E428D3AAD416664E56@orion-exch.orion.local>,<BE095FD07C20C5419BF398E428D3AAD416664E63@orion-exch.orion.local>",                "X-Originating-IP": "[10.23.160.157]",                "Accept-Language": "en-US",                "X-MS-Has-Attach": "yes",                "Content-Language": "en-US",                "Content-Type": "application/ms-tnef",                "X-PhishAlarm-Clear-Id": "876724f6-2b0c-4c4b-8d85-3813298527a1",                "X-PhishAlarm-Clear-Timeout": 45,                "X-PhishAlarm-Format": "PhishAlarm for Gmail; MethodOfDetermination=\"Guessing\"",                "X-PhishAlarm-Overcast-Trace-Token": "ZG-AEQ=ZHMACg=R9pKjo-6JX_EdjS2h7Mo",                "X-PhishAlarm-Reporter": "test-user-1@clear-gmail-testing.page",                "X-PhishAlarm-SES-key": "725d98a1-2d08-4350-97af-d22a6e57d152"            },            "urls": [                "http://www.google.com"            ],            "attachments": [                {                    "timestamp": "2019-01-28T09:43:87Z",                    "safename": "62aeae6f18dbe28939babe759c095c7b.pdf",                    "realnamePII": {                        "secret": "Hanhart Pioneer Valjoux 23 Flyback.pdf"                    },                    "size": 404674,                    "contentType": "application/pdf",                    "md5": "e64e6f2d9a148e948aafe4081e4f4f03",                    "sha256": "dda637869121ac6bede4e8127c8333375901940d6a5e87da4eb3ab250a1ad518"                }            ],            "abuseCopy": true        },        {            "sender": {                "email": "badguy@whatever.com"            },            "recipient": {                "email": "employee@acme.com"            },            "subject": "FW: Report me!",            "messageId": "<BE095FD07C20C5419BF398E428D3AAD416664E63@orion-exch.orion.local>",            "body": "<html dir=\"ltr\">removed</html>",            "bodyType": "html",            "headers": {                "Thread-Index": "AdTNIeEpSJX5TD0eRy+DKCAGay+zzgAABtQOAAAiV44AAwUbrg==",                "Received": "from ORION-EXCH.orion.local ([::1]) by orion-exch.orion.local ([::1]) with mapi id 14.03.0123.003; Mon, 25 Feb 2019 09:21:59 -0800",                "X-MS-TNEF-Correlator": "<BE095FD07C20C5419BF398E428D3AAD416664E78@orion-exch.orion.local>",                "Thread-Topic": "Report me!",                "Message-ID": "<BE095FD07C20C5419BF398E428D3AAD416664E78@orion-exch.orion.local>",                "Content-Transfer-Encoding": "binary",                "X-MS-Exchange-Organization-AuthAs": "Internal",                "In-Reply-To": "<BE095FD07C20C5419BF398E428D3AAD416664E63@orion-exch.orion.local>",                "X-MS-Exchange-Organization-AuthSource": "orion-exch.orion.local",                "Subject": "FW: Report me!",                "MIME-Version": "1.0",                "Date": "Mon, 25 Feb 2019 09:21:58 -0800",                "X-MS-Exchange-Organization-AuthMechanism": "04",                "X-MS-Exchange-Organization-SCL": "-1",                "References": "<F4F06DB4324F7649A88EA3C014334523166CE43E@orion-exch.orion.local>,<BE095FD07C20C5419BF398E428D3AAD416664E56@orion-exch.orion.local>,<BE095FD07C20C5419BF398E428D3AAD416664E63@orion-exch.orion.local>",                "X-Originating-IP": "[10.23.160.157]",                "Accept-Language": "en-US",                "X-MS-Has-Attach": "yes",                "Content-Language": "en-US",                "Content-Type": "application/ms-tnef"            },            "urls": [                "http://www.google.com"            ],            "attachments": [                {                    "timestamp": "2019-01-28T09:43:87Z",                    "safename": "62aeae6f18dbe28939babe759c095c7b.pdf",                    "realnamePII": {                        "secret": "Hanhart Pioneer Valjoux 23 Flyback.pdf"                    },                    "size": 404674,                    "contentType": "application/pdf",                    "md5": "e64e6f2d9a148e948aafe4081e4f4f03",                    "sha256": "dda637869121ac6bede4e8127c8333375901940d6a5e87da4eb3ab250a1ad518"                }            ],            "mimeContent": "removed",            "abuseCopy": false        }    ]}

​
Workflow Library Example​

Get Alert Details with Proofpoint Threat Response Auto Pull and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Download Original Abuse MessageGet Incident Details