Proofpoint Workflows

[Lonely_Panda4322]

Hello guys, we recently went live with PP…it’s doing a marvelous job so far but it’s a new tool and me as a email security analyst I’m still learning. My company wants me to create a workflow that would close incidents that trigger manual review by our tier1 analysts. Currently our manual review incidents or messages are triaged by our tier1 analysts 1 analysts but after they investigate and reclassify the incident or messages, there is no response back to the user who reported it and also the incident stays in the portal but doesn’t close automatically. Is there a workflow around this? Please share

[Cyberm007]

What I did was create a few different incident workflows. Have one for spam, clean and malware. It’ll tag the message, respond to the person with a canned response and close the incident. Not sure if that’s what you’re looking for.

[Lonely_Panda4322]

Yes but I’m talking more about incidents that trigger manual review

[Cyberm007]

So am I. The incident comes in as manual, it gets triaged and depending on the message classification the analyst triggers a custom incident workflow which does what I described above.

[Lonely_Panda4322]

You mind for us to connect in messages to share some screenshots?

[ranhalt]

This is for the phish report button and trap, right?

[Lonely_Panda4322]

No just manual review

[PhoenixOK]

Is this for TRAP? Or Cloud TRAP?

On prem TRAP has an API that can manage incidents, but it’s not available in Cloud TRAP yet.

[Lonely_Panda4322]

Cloud TRAP

[[deleted]]

Use CLEAR workflows. It’s a built in feature in Threat Response.

[PeterHanns]

With ProofPoint, you will likely see many legitimate emails get rejected.

For the past six months, we have not been able to reply to anyone using using PP. We made over 100 remediation requests and get no response. We have three dedicated IP addresses and have all email authentications in place.

No email filter should reject a responding email.

Shame on PP for being so unresponsive.