🧪 Community ✓ Claude Code ✓ Claude Desktop 🔌 Requires MCP Server • Email Security

Proofpoint

Proofpoint Email Protection - TAP, quarantine, threat intel, forensics, URL defense, VAP reports

🔌 Recommended MCP Server

Pair this plugin with the Proofpoint MCP for direct API access alongside skills and commands.

Installation

Install this plugin individually:

/plugin marketplace add wyre-technology/msp-claude-plugins --plugin proofpoint

Or install all MSP plugins at once:

/plugin marketplace add wyre-technology/msp-claude-plugins

Features

Forensics
People
Quarantine
Tap
Threat Intel
Url Defense

Skills

This plugin provides 7 skills that teach Claude about Proofpoint:

Skill	Description
`forensics`	Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats.
`people`	Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP) reports, attack index scoring, click susceptibility, top clickers, and user risk categorization for targeting security controls and training.
`quarantine`	Proofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine.
`tap`	Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across URL, attachment, and message-level vectors, click tracking, message disposition, SIEM integration feeds, and campaign correlation.
`threat-intel`	Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events.
`url-defense`	Proofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals.
`api-patterns`	Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.

Agents

This plugin provides 2 agents for autonomous task execution:

Agent	Description
`email-security-auditor`	Use this agent when auditing email security posture across Proofpoint-protected organizations, investigating threats via TAP intelligence, tracing specific emails, analyzing Very Attacked Persons (VAPs), or generating per-org security reports for MSP clients.
`vap-reporter`	Use this agent when analyzing Very Attacked Persons (VAPs) in Proofpoint — tracking executives and high-value targets who receive the most sophisticated or highest-volume attacks, surfacing patterns over time, and recommending enhanced protections for the highest-risk users across the MSP client portfolio.

Commands

Available slash commands:

Command	Description
`/check-threats`	View recent TAP threat events including blocked messages, delivered threats, and click activity
`/decode-url`	Decode a Proofpoint URL Defense rewritten URL back to the original URL
`/investigate-threat`	Deep-dive threat investigation with forensics, campaign context, and remediation options
`/release-quarantine`	Release one or more quarantined messages to their intended recipients
`/search-quarantine`	Search quarantined messages in Proofpoint by sender, recipient, subject, or reason
`/vap-report`	Get the Very Attacked People (VAP) report showing the most targeted users

API Reference

Base URL
Authentication
Rate Limit
Documentation

Example Usage

View recent TAP threat events including blocked messages, delivered threats, and click activity

/check-threats

Decode a Proofpoint URL Defense rewritten URL back to the original URL

/decode-url

Deep-dive threat investigation with forensics, campaign context, and remediation options

/investigate-threat

Release one or more quarantined messages to their intended recipients

/release-quarantine

Search quarantined messages in Proofpoint by sender, recipient, subject, or reason

/search-quarantine

Get the Very Attacked People (VAP) report showing the most targeted users

/vap-report

Using Skills

/skill proofpoint:forensics

Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats.