We've reorganized our navigation structure to align directly with your operational workflows. See the Google SecOps release notes for more information.

Proofpoint Email Protection

This document provides guidance on how to integrate Proofpoint Email Protection with Google SecOps.

Integrate Proofpoint Email Protection with Google Security Operations

For detailed instructions on how to configure an integration in Google SecOps, see Configure integrations .

Integration inputs

To configure the integration, use the following parameters:

Parameters

API Root

Required

API root of your Proofpoint Email Protection instance.

Username

Required

Username of your Proofpoint Email Protection instance.

Password

Required

Password of your Proofpoint Email Protection instance.

Verify SSL

Optional

If checked, verifies that the SSL connection certificate to the Proofpoint server is valid.

Actions

Before running actions, make sure to configure their respective parameters, if any.

Enrich Entities

Enrich entities with Proofpoint Email Protection.

Entities

This action runs on the following entities:

Hostname
User

Action inputs

N/A

Action outputs

Action output type

Case wall attachment

N/A

Case wall link

N/A

Case wall table

N/A

Enrichment table

Available

JSON result

N/A

Script result

Available

Entity enrichment

Enrichment field	Logic
`dlpviolation`	N/A
`messagestatus`	N/A

Script result

Script result name	Value
is_success	True/False

Ping

Test the Proofpoint Protection Server connectivity.

Entities

This action runs on all entities.

Action inputs

N/A

Action outputs

Action output type

Case wall attachment

N/A

Case wall link

N/A

Case wall table

N/A

Enrichment table

N/A

JSON result

N/A

Script result

Available

Script result

Script result name	Value
is_success	True/False

Search Quarantined Emails

Use the Search Quarantined Emailsaction to trace and analyze information about quarantined messages in Proofpoint Email Protection.

This action doesn't run on Google SecOps entities.

Action inputs

The Search Quarantined Emailsaction requires the following parameters:

Parameter

Description

`Message GUID`

Optional.

The unique message GUID to search for.

`Message ID`

Optional.

The unique Internet Message ID to search for.

`Sender`

Optional.

The email address of the sender.

`Recipient`

Optional.

The email address of the recipient.

`Subject`

Optional.

The subject of the quarantined email.

`Time Frame`

Optional.

Specify a time frame for the results.

The possible values are as follows:

`Last Hour`
`Last 6 Hours`
`Last 24 Hours`
`Last Week`
`Custom`

The default value is `Last Hour`.

`Start Time`

Optional.

Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.

`End Time`

Optional.

Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.

`Folder Name`

Optional.

The name of the quarantine folder. The default value is `Quarantine`.

`Query ID`

Optional.

An ID used for the REST client to track the search results.

`Fetch DLP Violation`

Optional.

Select the level of DLP violation data to fetch.

The possible values are as follows:

`No`
`Basic`
`Detailed`

The default value is `No`.

`Fetch Message Status`

Optional.

If selected, fetches the message status and comments. Disabled by default.

`Max Results To Return`

Optional.

The maximum number of results to return. The default value is `100`. The maximum value is `1000`.

Action outputs

The Search Quarantined Emailsaction provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Available
Enrichment table	Not available
JSON result	Available
Script result	Available

JSON result

The following example shows the JSON result output received when using the Search Quarantined Emailsaction:

  [ 
  
 { 
  
 "processingserver" 
 : 
  
 "mta1" 
 , 
  
 "date" 
 : 
  
 "2026-05-25 09:30:00" 
 , 
  
 "subject" 
 : 
  
 "Test Subject" 
 , 
  
 "messageid" 
 : 
  
 "message-id-2" 
 , 
  
 "folder" 
 : 
  
 "PCI" 
 , 
  
 "size" 
 : 
  
 1200 
 , 
  
 "rcpts" 
 : 
  
 [ 
  
 "recipient@example.com" 
  
 ], 
  
 "from" 
 : 
  
 "sender@example.com" 
 , 
  
 "spamscore" 
 : 
  
 99 
 , 
  
 "guid" 
 : 
  
 "message-guid-1" 
 , 
  
 "host_ip" 
 : 
  
 "10.10.10.10" 
 , 
  
 "localguid" 
 : 
  
 "14:14:7" 
  
 } 
 ]

Script result

The following table lists the value for the script result output when using the Search Quarantined Emailsaction:

Script result name	Value
`is_success`	`true` or `false`

Delete Quarantined Email

Use the Delete Quarantined Emailaction to permanently delete quarantined messages from the Proofpoint quarantine folder.

This action doesn't run on Google SecOps entities.

Action inputs

The Delete Quarantined Emailaction requires the following parameters:

Parameter

Description

`Message GUIDs`

Required.

The unique message GUID(s) to delete. Supports a comma-separated list for multiple GUIDs.

`Folder Name`

Required.

The folder name where the message is stored (for example, `Quarantine` or `PCI`).

`Time Frame`

Optional.

Specify a time frame for the results.

The possible values are as follows:

`Last Hour`
`Last 6 Hours`
`Last 24 Hours`
`Last Week`
`Custom`

The default value is `Last Hour`.

`Start Time`

Optional.

Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.

`End Time`

Optional.

Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.

`Deleted Folder Name`

Optional.

The folder name to move the deleted messages to.

Action outputs

The Delete Quarantined Emailaction provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Delete Quarantined Emailaction:

Script result name	Value
`is_success`	`true` or `false`

Move Quarantined Email

Use the Move Quarantined Emailaction to move quarantined messages to a specified target folder or rule queue.

This action doesn't run on Google SecOps entities.

Action inputs

The Move Quarantined Emailaction requires the following parameters:

Parameter

Description

`Message GUIDs`

Required.

The unique message GUID(s) to move. Supports a comma-separated list for multiple GUIDs.

`Folder Name`

Required.

The folder name where the message is stored (for example, `Quarantine` or `PCI`).

`Time Frame`

Optional.

Specify a time frame for the results.

The possible values are as follows:

`Last Hour`
`Last 6 Hours`
`Last 24 Hours`
`Last Week`
`Custom`

The default value is `Last Hour`.

`Start Time`

Optional.

Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.

`End Time`

Optional.

Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.

`Target Folder Name`

Required.

The target folder name to move the quarantined emails to.

Action outputs

The Move Quarantined Emailaction provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Move Quarantined Emailaction:

Script result name	Value
`is_success`	`true` or `false`

Resubmit Quarantined Email

Use the Resubmit Quarantined Emailaction to resubmit specified quarantined messages back into the main filtering process queue for re-evaluation.

This action doesn't run on Google SecOps entities.

Action inputs

The Resubmit Quarantined Emailaction requires the following parameters:

Parameter

Description

`Message GUIDs`

Required.

The unique message GUID(s) to resubmit. Supports a comma-separated list for multiple GUIDs.

`Folder Name`

Required.

The folder name where the message is stored (for example, `Quarantine` or `PCI`).

`Time Frame`

Optional.

Specify a time frame for the results.

The possible values are as follows:

`Last Hour`
`Last 6 Hours`
`Last 24 Hours`
`Last Week`
`Custom`

The default value is `Last Hour`.

`Start Time`

Optional.

Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.

`End Time`

Optional.

Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.

Action outputs

The Resubmit Quarantined Emailaction provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Resubmit Quarantined Emailaction:

Script result name	Value
`is_success`	`true` or `false`

Need more help? Get answers from Community members and Google SecOps professionals.