What it does. Deploy and configure Proofpoint Email Protection as a secure email gateway Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-proofpoint-email-security-gateway, or copy the skill folder into ~/.claude/skills/implementing-proofpoint-email-security-gateway/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/SKILL.md
SKILL.md (verbatim)
name: implementing-proofpoint-email-security-gateway
description: Deploy and configure Proofpoint Email Protection as a secure email gateway
to detect and block phishing, malware, BEC, and spam before messages reach user
inboxes.
domain: cybersecurity
subdomain: phishing-defense
tags:
- email-security
- proofpoint
- secure-email-gateway
- phishing
- anti-spam
- anti-malware
- bec
- email-filtering
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566
- T1598
- T1534
- T1036
- T1027
mitre_f3:
version: '1.1'
tactics:
- reconnaissance
- initial-access
- stealth
- positioning
techniques:
- id: T1598
name: Phishing for Information
tactic: reconnaissance
source: attack
- id: T1660
name: Phishing
tactic: initial-access
source: attack
- id: T1672
name: Email Spoofing
tactic: stealth
source: attack
- id: F1032
name: Impersonate Official
tactic: initial-access
source: f3
- id: F1029
name: Gather Customer Information
tactic: reconnaissance
source: f3
- id: F1005.006
name: 'Account Manipulation: Change of Payment Details'
tactic: positioning
source: f3
Implementing Proofpoint Email Security Gateway
Overview
Proofpoint Email Protection is a cloud-native secure email gateway (SEG) that acts as a security checkpoint where all inbound and outbound mail traffic routes through the gateway before reaching user inboxes. It combines signature-based detection for known malware, machine learning algorithms for emerging threats, real-time threat intelligence feeds, URL rewriting with time-of-click sandboxing, and behavioral analysis for BEC detection. Proofpoint processes over 2.8 billion emails daily and blocks over 1 million extortion attempts per day.
When to Use
- When deploying or configuring implementing proofpoint email security gateway capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Proofpoint Email Protection license (PPS on-premises or Proofpoint on Demand cloud)
- Administrative access to DNS management for MX record changes
- Microsoft 365 or Google Workspace email environment
- Understanding of mail flow architecture and SPF/DKIM/DMARC
- Network firewall rules permitting Proofpoint IP ranges
Key Concepts
Deployment Models
- MX-Based Gateway (Traditional SEG): All mail routes through Proofpoint via MX record changes; intercepts threats before delivery
- API-Based Integration: Connects directly to Microsoft 365 or Google Workspace via API; no MX changes required; can be operational within 48 hours
- Hybrid Deployment: Combines gateway and API for layered protection
Core Detection Technologies
- Impostor Classifier: ML model detecting BEC/impersonation with no malicious URLs or attachments
- URL Defense: Rewrites URLs and performs real-time sandboxing at time of click
- Attachment Defense: Sandboxes suspicious attachments in virtual environments
- Nexus Threat Graph: Cross-customer threat intelligence correlation engine
- Supplier Threat Detection: Identifies compromised vendor email accounts
Protection Layers
| Layer |
Technology |
Threat Type |
| Connection |
IP reputation, rate limiting |
Spam botnets |
| Authentication |
SPF, DKIM, DMARC enforcement |
Spoofing |
| Content |
ML classifiers, NLP analysis |
BEC, phishing |
| URL |
Rewriting + time-of-click sandbox |
Credential theft |
| Attachment |
Static + dynamic sandboxing |
Malware, ransomware |
| Post-delivery |
TRAP (auto-retraction) |
Weaponized after delivery |
Workflow
Step 1: Plan Mail Flow Architecture
- Document current MX records and mail flow path
- Identify all legitimate sending sources (marketing platforms, CRM, ticketing systems)
- Map inbound connectors and transport rules in Microsoft 365 or Google Workspace
- Plan IP allowlisting for Proofpoint egress IPs on receiving infrastructure
- Configure SPF record to include Proofpoint:
v=spf1 include:spf.protection.outlook.com include:spf-a.proofpoint.com -all
- Create organizational units matching business structure
- Define inbound mail policies: anti-spam, anti-virus, impostor detection
- Configure Smart Search quarantine with end-user digest notifications
- Set up Proofpoint Encryption for sensitive outbound messages
- Enable Targeted Attack Protection (TAP) for URL and attachment sandboxing
Step 3: Deploy Email Authentication
- Configure DKIM signing through Proofpoint for outbound messages
- Set DMARC policy to monitor mode initially:
v=DMARC1; p=none; rua=mailto:dmarc@company.com
- Enable inbound DMARC enforcement to reject spoofed messages
- Configure anti-spoofing rules for executive impersonation protection
Step 4: Enable Advanced Threat Protection
- Activate URL Defense with rewriting enabled for all inbound messages
- Configure Attachment Defense sandbox policies (safe attachment mode)
- Enable Threat Response Auto-Pull (TRAP) for post-delivery remediation
- Set up TAP Dashboard alerts for targeted attack campaigns
- Configure Supplier Risk monitoring for vendor email compromise
Step 5: Migrate MX Records
- Lower MX record TTL to 300 seconds 48 hours before cutover
- Update MX records to point to Proofpoint:
company-com.mail.protection.proofpoint.com
- Configure connector restrictions in Microsoft 365 to accept mail only from Proofpoint IPs
- Monitor mail flow through Proofpoint Message Trace for 48-72 hours
- Verify no legitimate mail is being blocked or delayed
Step 6: Tune and Optimize
- Review quarantine and false positive/negative rates weekly for first month
- Adjust spam thresholds based on organizational tolerance
- Add approved senders and safe lists for legitimate bulk mail
- Configure data loss prevention (DLP) rules for outbound sensitive content
- Enable email warning banners for external sender identification
- Proofpoint TAP Dashboard: Real-time threat visibility and campaign tracking
- Proofpoint TRAP: Automated post-delivery email retraction
- Proofpoint SER (Spam/End-user Release): Self-service quarantine management
- Proofpoint Closed-Loop Email Analysis (CLEAR): Phishing report button integration
- MX Toolbox: DNS record verification and mail flow testing
Validation
- All inbound email routes through Proofpoint (verify MX records and message headers)
- TAP Dashboard shows threat detections and blocked campaigns
- URL Defense rewrites links in test messages and sandboxes at click time
- Attachment Defense detonates test malware samples in sandbox
- TRAP successfully retracts test phishing message from inboxes post-delivery
- False positive rate below 0.1% after initial tuning period
- DMARC/SPF/DKIM authentication passes for all legitimate outbound mail
Other files in this skill
assets/template.md (verbatim)
Proofpoint Email Security Gateway Deployment Template
Pre-Deployment Checklist
Policy Configuration
| Policy |
Scope |
Action |
Status |
| Anti-spam (inbound) |
All users |
Quarantine high confidence |
|
| Anti-virus |
All users |
Block + notify admin |
|
| Impostor detection |
VIP list |
Quarantine + SOC alert |
|
| URL Defense |
All users |
Rewrite + sandbox at click |
|
| Attachment Defense |
All users |
Sandbox suspicious types |
|
| TRAP auto-pull |
All users |
Retract post-delivery threats |
|
| DLP (outbound) |
All users |
Block + manager notify |
|
VIP Protection List
| Name |
Title |
Email |
Protected |
|
CEO |
|
Yes |
|
CFO |
|
Yes |
|
CTO |
|
Yes |
|
VP Finance |
|
Yes |
MX Record Migration
| Record Type |
Priority |
Old Value |
New Value |
| MX |
10 |
|
{org}.mail.protection.proofpoint.com |
Post-Deployment Validation
references/api-reference.md (verbatim)
API Reference: Proofpoint Email Security Gateway
Libraries Used
| Library |
Purpose |
requests |
HTTP client for Proofpoint TAP API v2 |
json |
Parse threat and message event data |
os |
Read PROOFPOINT_SP and PROOFPOINT_SECRET credentials |
datetime |
Build ISO-8601 time range queries |
Installation
pip install requests
Authentication
Proofpoint TAP API uses HTTP Basic Auth with service principal and secret:
import requests
import os
from requests.auth import HTTPBasicAuth
PROOFPOINT_URL = "https://tap-api-v2.proofpoint.com"
auth = HTTPBasicAuth(
os.environ["PROOFPOINT_SP"], # Service Principal
os.environ["PROOFPOINT_SECRET"], # Secret
)
TAP API v2 Endpoints
| Method |
Endpoint |
Description |
| GET |
/v2/siem/messages/blocked |
Messages blocked by Proofpoint |
| GET |
/v2/siem/messages/delivered |
Messages delivered (with threats) |
| GET |
/v2/siem/clicks/blocked |
Blocked URL clicks |
| GET |
/v2/siem/clicks/permitted |
Permitted URL clicks (with threats) |
| GET |
/v2/siem/all |
All events (messages + clicks) |
| GET |
/v2/siem/issues |
Campaign and threat issues |
| GET |
/v2/people/vap |
Very Attacked People report |
| GET |
/v2/forensics |
Threat forensics detail |
| POST |
/v2/quarantine/release |
Release message from quarantine |
| POST |
/v2/quarantine/delete |
Delete message from quarantine |
Core Operations
Fetch Blocked Messages
from datetime import datetime, timedelta
def get_blocked_messages(hours_back=1):
since = (datetime.utcnow() - timedelta(hours=hours_back)).strftime(
"%Y-%m-%dT%H:%M:%SZ"
)
resp = requests.get(
f"{PROOFPOINT_URL}/v2/siem/messages/blocked",
auth=auth,
params={
"sinceTime": since,
"format": "json",
},
timeout=60,
)
resp.raise_for_status()
return resp.json().get("messagesBlocked", [])
Fetch Permitted Clicks with Threats
def get_permitted_clicks(hours_back=24):
since = (datetime.utcnow() - timedelta(hours=hours_back)).strftime(
"%Y-%m-%dT%H:%M:%SZ"
)
resp = requests.get(
f"{PROOFPOINT_URL}/v2/siem/clicks/permitted",
auth=auth,
params={"sinceTime": since, "format": "json"},
timeout=60,
)
resp.raise_for_status()
return resp.json().get("clicksPermitted", [])
Get All SIEM Events
def get_all_events(hours_back=1):
since = (datetime.utcnow() - timedelta(hours=hours_back)).strftime(
"%Y-%m-%dT%H:%M:%SZ"
)
resp = requests.get(
f"{PROOFPOINT_URL}/v2/siem/all",
auth=auth,
params={"sinceTime": since, "format": "json"},
timeout=120,
)
resp.raise_for_status()
data = resp.json()
return {
"messages_blocked": data.get("messagesBlocked", []),
"messages_delivered": data.get("messagesDelivered", []),
"clicks_blocked": data.get("clicksBlocked", []),
"clicks_permitted": data.get("clicksPermitted", []),
}
Get Very Attacked People (VAP)
def get_vap_report(days=30):
resp = requests.get(
f"{PROOFPOINT_URL}/v2/people/vap",
auth=auth,
params={"window": days, "size": 100},
timeout=60,
)
resp.raise_for_status()
return resp.json().get("users", [])
def extract_iocs(events):
iocs = {"urls": set(), "senders": set(), "subjects": set(), "sha256": set()}
for msg in events.get("messages_blocked", []) + events.get("messages_delivered", []):
iocs["senders"].add(msg.get("sender", ""))
iocs["subjects"].add(msg.get("subject", ""))
for threat in msg.get("threatsInfoMap", []):
if threat.get("threatUrl"):
iocs["urls"].add(threat["threatUrl"])
if threat.get("sha256"):
iocs["sha256"].add(threat["sha256"])
return {k: list(v) for k, v in iocs.items()}
Query Parameters
| Parameter |
Type |
Description |
sinceTime |
ISO-8601 |
Start time (required, max 1 hour back for /all) |
sinceSeconds |
int |
Seconds before now (alternative to sinceTime) |
format |
string |
Response format: json (default) or syslog |
threatType |
string |
Filter: url, attachment, messageText |
threatStatus |
string |
Filter: active, cleared, falsePositive |
{
"messagesBlocked": [
{
"GUID": "abc123-def456",
"QID": "r1234567",
"sender": "attacker@malicious.example.com",
"recipient": ["user@company.com"],
"subject": "Invoice #12345 Attached",
"messageTime": "2025-01-15T10:30:00Z",
"threatsInfoMap": [
{
"threat": "https://evil.example.com/payload",
"threatType": "url",
"threatStatus": "active",
"classification": "phish",
"sha256": "a1b2c3d4e5f6..."
}
],
"malwareScore": 100,
"phishScore": 95,
"spamScore": 0
}
]
}
references/standards.md (verbatim)
Standards & References: Implementing Proofpoint Email Security Gateway
Industry Standards
- NIST SP 800-177 Rev.1: Trustworthy Email - guidelines for email security deployment
- RFC 7208: Sender Policy Framework (SPF) for authorizing use of domains in email
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- RFC 7489: Domain-based Message Authentication, Reporting & Conformance (DMARC)
- CIS Controls v8 Control 9: Email and Web Browser Protections
MITRE ATT&CK References
- T1566.001: Phishing: Spearphishing Attachment
- T1566.002: Phishing: Spearphishing Link
- T1566.003: Phishing: Spearphishing via Service
- T1534: Internal Spearphishing
- T1598: Phishing for Information
- T1114.003: Email Collection: Email Forwarding Rule
Proofpoint-Specific References
- Proofpoint Email Protection (PPS): On-premises protection platform
- Proofpoint on Demand (PoD): Cloud-hosted email security service
- Proofpoint TAP (Targeted Attack Protection): Advanced threat detection
- Proofpoint TRAP (Threat Response Auto-Pull): Post-delivery remediation
- Proofpoint Nexus Threat Graph: Cross-customer threat intelligence
Compliance Alignment
| Framework |
Control |
Description |
| SOC 2 |
CC6.1 |
Logical and physical access controls |
| HIPAA |
164.312(a)(1) |
Access control for ePHI |
| PCI DSS 4.0 |
5.2 |
Anti-malware solutions |
| NIST CSF 2.0 |
PR.DS-1 |
Data-at-rest and data-in-transit protection |
| ISO 27001 |
A.8.23 |
Web filtering |
Email Security Gateway Market
- Proofpoint processes 2.8+ billion messages daily (2024)
- Gartner Magic Quadrant Leader for Email Security (2019-2024)
- Over 50% of Fortune 100 companies use Proofpoint
references/workflows.md (verbatim)
Workflows: Implementing Proofpoint Email Security Gateway
Workflow 1: Inbound Mail Processing Pipeline
External sender sends email
|
v
[DNS MX lookup resolves to Proofpoint]
|
v
[Connection-level filtering]
+-- IP reputation check (Proofpoint Nexus)
+-- Rate limiting and connection throttling
+-- REJECT if known-bad IP
|
v
[Authentication checks]
+-- SPF validation
+-- DKIM signature verification
+-- DMARC policy evaluation
+-- FAIL actions: quarantine or reject per policy
|
v
[Content analysis]
+-- Anti-spam scoring (ML classifier)
+-- Anti-virus scanning (multi-engine)
+-- Impostor classifier (BEC detection)
+-- NLP analysis for social engineering language
|
v
[URL Defense]
+-- Extract all URLs from body and attachments
+-- Rewrite URLs through Proofpoint proxy
+-- Pre-delivery URL reputation check
+-- BLOCK if known malicious
|
v
[Attachment Defense]
+-- Static analysis (signatures, heuristics)
+-- Dynamic sandbox detonation (if suspicious)
+-- Wait for sandbox verdict (up to 7 minutes)
+-- QUARANTINE if malicious
|
v
[Policy action]
+-- DELIVER: Clean email to mailbox
+-- TAG: Add warning banner for external/suspicious
+-- QUARANTINE: Hold for admin/user review
+-- REJECT: Block with NDR to sender
Workflow 2: Post-Delivery Threat Response (TRAP)
Threat intelligence update received
|
v
[TRAP scans delivered messages retroactively]
+-- URL becomes malicious after delivery
+-- New malware signature matches delivered attachment
|
v
[Auto-Pull action triggered]
+-- Move message from user inbox to quarantine
+-- Log retraction in TRAP dashboard
+-- Notify SOC team of post-delivery threat
|
v
[SOC investigation]
+-- Review TRAP alert and threat details
+-- Check if user clicked URL before retraction
+-- If clicked: initiate incident response
+-- If not clicked: close as contained
|
v
[Update policies]
+-- Add sender/domain to block list if needed
+-- Create detection rule for similar campaigns
+-- Update TAP Dashboard threat tracking
Workflow 3: Phishing Report and CLEAR Integration
User receives suspicious email
|
v
[User clicks "Report Phishing" button (Proofpoint CLEAR)]
|
v
[Email forwarded to Proofpoint analysis pipeline]
+-- Automated classification (phishing/spam/clean)
+-- URL and attachment analysis
|
v
[CLEAR verdict]
+-- MALICIOUS: Auto-retract from all inboxes that received it
+-- SPAM: Move to junk for all recipients
+-- CLEAN: Return to inbox, thank reporter
|
v
[Metrics and feedback]
+-- Track reporter accuracy rate
+-- Update user risk score
+-- Feed into security awareness metrics
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.