Proofpoint Log Reference

Log Samples

Learn what raw Proofpoint events look like before they're processed in Logpoint:

Space-separated Key-Value Pair Format

<13>Jan 29 10:20:45 Proofpoint <141>2018-01-29T04:20:45.636105-05:00 m0000409 filter_instance1[25629]: rprt s=2ft08x8gs2 mod=session cmd=disconnect module= rule= action= helo=abc14.xxx.group msgs=5 rcpts=5 routes=PRAbsolut,PRAbsolut365,PRAbsolutAD,PRWyborowaO365,ABC_IPSenders,Rpt_o365Emails,WyborowaMembersPolicyRoute,allow_relay,asia_disclaimer_exceptions,default_inbound,firewallsafe,outbound,xxx duration=2.089 elapsed=14.02

JSON Format - Message Blocked Event

{
  "queryEndTime": "2021-06-09T17:29:00Z+05:00",
  "clicksPermitted": [],
  "clicksBlocked": [],
  "messagesDelivered": [],
  "messagesBlocked": [{
    "spamScore": 100,
    "phishScore": 100,
    "threatsInfoMap": [{
      "threatID": "cbe157bc7404aebf7931f692a609cf093243037964ab32b31e63bb5609ae0aaf",
      "threatStatus": "active",
      "classification": "phish",
      "threatUrl": "https://threat.com/25xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx/threat/email/...",
      "threatTime": "2021-06-09T13:30:18.000Z",
      "threat": "https://bit.ly/3pD1DF7",
      "campaignID": null,
      "threatType": "url"
    }],
    "messageTime": "2021-06-09T17:11:11.000Z",
    "impostorScore": 0.0,
    "malwareScore": 0,
    "cluster": "regent_hosted",
    "subject": "=?ISO-8859-1?Q?John_Re=3ASalut=5F?=",
    "quarantineFolder": "Phish",
    "quarantineRule": "in_regent_phish",
    "policyRoutes": ["default_inbound", "allow_relay", "Regent_Only", "pp_spoofsafe"],
    "modulesRun": ["access", "av", "zerohour", "spf", "dkimv", "spam", "urldefense"],
    "messageSize": 9475,
    "headerFrom": "\"Paul\" <[email protected]>",
    "fromAddress": ["[email protected]"],
    "toAddresses": ["[email protected]", "[email protected]", "[email protected]"]
  }]
}

Proofpoint Targeted Attack Protection - Click Event

{
  "queryEndTime": "2023-04-05T13:35:00Z",
  "clicksPermitted": [{
    "url": "https://sncf.bravosolution.com/esop/guest/login.do?qvu=9223807301872B18ACE4",
    "classification": "phish",
    "clickTime": "2023-04-05T13:09:33.000Z",
    "threatTime": "2023-04-05T13:29:54.000Z",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36",
    "campaignId": "",
    "id": "50e9abb3-4114-4e96-b3fe-8926533c784e",
    "clickIP": "62.8.9.180",
    "sender": "[email protected]",
    "recipient": "[email protected]",
    "senderIP": "3.66.57.96",
    "GUID": "DlL8ubmkxqnPvh1w3F6HBEdhp9MWwQJg",
    "threatID": "b8aa0b7cdfbf67421896ca8982691327f703e6bdf07d97a541f67c7a83db66a5",
    "threatURL": "https://threatinsight.proofpoint.com/...",
    "threatStatus": "active",
    "messageID": "<tlhadm_lb1#XJA7gQ#Scheduler-00252#[email protected]>"
  }]
}