We've reorganized our navigation structure to align directly with your operational workflows. See the Google SecOps release notes for more information.

Proofpoint Email Protection

This document provides guidance on how to integrate Proofpoint Email Protection with Google SecOps.

Integrate Proofpoint Email Protection with Google Security Operations

For detailed instructions on how to configure an integration in Google SecOps, see Configure integrations.

Integration inputs

To configure the integration, use the following parameters:

Parameters
`API Root`	Required API root of your Proofpoint Email Protection instance.
`Username`	Required Username of your Proofpoint Email Protection instance.
`Password`	Required Password of your Proofpoint Email Protection instance.
`Verify SSL`	Optional If checked, verifies that the SSL connection certificate to the Proofpoint server is valid.

Actions

Before running actions, make sure to configure their respective parameters, if any.

Enrich Entities

Enrich entities with Proofpoint Email Protection.

Entities

This action runs on the following entities:

Hostname
User

Action inputs

N/A

Action outputs

Action output type
Case wall attachment	N/A
Case wall link	N/A
Case wall table	N/A
Enrichment table	Available
JSON result	N/A
Script result	Available

Entity enrichment

Enrichment field	Logic
`dlpviolation`	N/A
`messagestatus`	N/A

Script result

Script result name	Value
is_success	True/False

Ping

Test the Proofpoint Protection Server connectivity.

Entities

This action runs on all entities.

Action inputs

N/A

Action outputs

Action output type
Case wall attachment	N/A
Case wall link	N/A
Case wall table	N/A
Enrichment table	N/A
JSON result	N/A
Script result	Available

Script result

Script result name	Value
is_success	True/False

Search Quarantined Emails

Use the Search Quarantined Emails action to trace and analyze information about quarantined messages in Proofpoint Email Protection.

This action doesn't run on Google SecOps entities.

Action inputs

The Search Quarantined Emails action requires the following parameters:

Parameter	Description
`Message GUID`	Optional. The unique message GUID to search for.
`Message ID`	Optional. The unique Internet Message ID to search for.
`Sender`	Optional. The email address of the sender.
`Recipient`	Optional. The email address of the recipient.
`Subject`	Optional. The subject of the quarantined email.
`Time Frame`	Optional. Specify a time frame for the results. The possible values are as follows: `Last Hour` `Last 6 Hours` `Last 24 Hours` `Last Week` `Custom` The default value is `Last Hour`.
`Start Time`	Optional. Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.
`End Time`	Optional. Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.
`Folder Name`	Optional. The name of the quarantine folder. The default value is `Quarantine`.
`Query ID`	Optional. An ID used for the REST client to track the search results.
`Fetch DLP Violation`	Optional. Select the level of DLP violation data to fetch. The possible values are as follows: `No` `Basic` `Detailed` The default value is `No`.
`Fetch Message Status`	Optional. If selected, fetches the message status and comments. Disabled by default.
`Max Results To Return`	Optional. The maximum number of results to return. The default value is `100`. The maximum value is `1000`.

Action outputs

The Search Quarantined Emails action provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Available
Enrichment table	Not available
JSON result	Available
Script result	Available

JSON result

The following example shows the JSON result output received when using the Search Quarantined Emails action:

[
  {
    "processingserver": "mta1",
    "date": "2026-05-25 09:30:00",
    "subject": "Test Subject",
    "messageid": "message-id-2",
    "folder": "PCI",
    "size": 1200,
    "rcpts": [
      "recipient@example.com"
    ],
    "from": "sender@example.com",
    "spamscore": 99,
    "guid": "message-guid-1",
    "host_ip": "10.10.10.10",
    "localguid": "14:14:7"
  }
]

Script result

The following table lists the value for the script result output when using the Search Quarantined Emails action:

Script result name	Value
`is_success`	`true` or `false`

Delete Quarantined Email

Use the Delete Quarantined Email action to permanently delete quarantined messages from the Proofpoint quarantine folder.

This action doesn't run on Google SecOps entities.

Action inputs

The Delete Quarantined Email action requires the following parameters:

Parameter	Description
`Message GUIDs`	Required. The unique message GUID(s) to delete. Supports a comma-separated list for multiple GUIDs.
`Folder Name`	Required. The folder name where the message is stored (for example, `Quarantine` or `PCI`).
`Time Frame`	Optional. Specify a time frame for the results. The possible values are as follows: `Last Hour` `Last 6 Hours` `Last 24 Hours` `Last Week` `Custom` The default value is `Last Hour`.
`Start Time`	Optional. Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.
`End Time`	Optional. Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.
`Deleted Folder Name`	Optional. The folder name to move the deleted messages to.

Action outputs

The Delete Quarantined Email action provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Delete Quarantined Email action:

Script result name	Value
`is_success`	`true` or `false`

Move Quarantined Email

Use the Move Quarantined Email action to move quarantined messages to a specified target folder or rule queue.

This action doesn't run on Google SecOps entities.

Action inputs

The Move Quarantined Email action requires the following parameters:

Parameter	Description
`Message GUIDs`	Required. The unique message GUID(s) to move. Supports a comma-separated list for multiple GUIDs.
`Folder Name`	Required. The folder name where the message is stored (for example, `Quarantine` or `PCI`).
`Time Frame`	Optional. Specify a time frame for the results. The possible values are as follows: `Last Hour` `Last 6 Hours` `Last 24 Hours` `Last Week` `Custom` The default value is `Last Hour`.
`Start Time`	Optional. Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.
`End Time`	Optional. Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.
`Target Folder Name`	Required. The target folder name to move the quarantined emails to.

Action outputs

The Move Quarantined Email action provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Move Quarantined Email action:

Script result name	Value
`is_success`	`true` or `false`

Resubmit Quarantined Email

Use the Resubmit Quarantined Email action to resubmit specified quarantined messages back into the main filtering process queue for re-evaluation.

This action doesn't run on Google SecOps entities.

Action inputs

The Resubmit Quarantined Email action requires the following parameters:

Parameter	Description
`Message GUIDs`	Required. The unique message GUID(s) to resubmit. Supports a comma-separated list for multiple GUIDs.
`Folder Name`	Required. The folder name where the message is stored (for example, `Quarantine` or `PCI`).
`Time Frame`	Optional. Specify a time frame for the results. The possible values are as follows: `Last Hour` `Last 6 Hours` `Last 24 Hours` `Last Week` `Custom` The default value is `Last Hour`.
`Start Time`	Optional. Specify the start time for the results in ISO 8601 format. This parameter is required if `Custom` is selected for the `Time Frame` parameter.
`End Time`	Optional. Specify the end time for the results in ISO 8601 format. If left blank and `Custom` is selected for the `Time Frame` parameter, the current time is used.

Action outputs

The Resubmit Quarantined Email action provides the following outputs:

Action output type	Availability
Case wall attachment	Not available
Case wall link	Not available
Case wall table	Not available
Enrichment table	Not available
JSON result	Not available
Script result	Available

Script result

The following table lists the value for the script result output when using the Resubmit Quarantined Email action:

Script result name	Value
`is_success`	`true` or `false`

Need more help? Get answers from Community members and Google SecOps professionals.