List Delivered Messages

List events of delivered messages which contained a known threat.

External Documentation

To learn more, visit the Proofpoint TAP documentation.

Basic Parameters

Parameter	Description
Starting Time	The starting time of the search interval. End time is the current server time.
Threat Status	Returns only chosen threat status.
Threat Type	Returns only chosen threat types.

Advanced Parameters

Parameter	Description
Interval	The interval of the events returned. Maximum interval is 1 hour. For example: 2016-05-01T12:00:00Z/2016-05-01T13:00:00Z.
Seconds Since	The size of the search interval in seconds starting from the current server time. Valid range: 30-3600

Example Output

{
	"queryEndTime": "2001-09-17T04:35:30.550Z",
	"messagesDelivered": [
		{
			"spamScore": 1,
			"phishScore": 1,
			"threatsInfoMap": [
				{
					"threatID": "<string>",
					"threatStatus": "<string>",
					"classification": "<string>",
					"detectionType": "<string>",
					"threatUrl": "<string>",
					"threatTime": "2001-09-17T04:35:30.550Z",
					"threat": "<string>",
					"campaignID": null,
					"actors": [],
					"threatType": "<string>"
				},
				{
					"threatID": "<string>",
					"threatStatus": "<string>",
					"classification": "<string>",
					"detectionType": "<string>",
					"threatUrl": "<string>",
					"threatTime": "2021-12-24T07:53:59.655Z",
					"threat": "<string>",
					"campaignID": null,
					"actors": [],
					"threatType": "<string>"
				}
			],
			"messageTime": "2022-08-25T17:19:39.809Z",
			"impostorScore": 2,
			"malwareScore": 2,
			"cluster": "<string>",
			"subject": "<string>",
			"quarantineFolder": null,
			"quarantineRule": null,
			"policyRoutes": [
				"<string>",
				"<string>"
			],
			"modulesRun": [
				"<string>",
				"<string>"
			],
			"messageSize": 66660,
			"headerFrom": "<string>",
			"headerReplyTo": null,
			"fromAddress": [
				"<string>"
			],
			"ccAddresses": [],
			"replyToAddress": [],
			"toAddresses": [
				"<string>"
			],
			"xmailer": null,
			"messageParts": [
				{
					"disposition": "<string>",
					"sha256": "<string>",
					"md5": "<string>",
					"filename": "<string>",
					"sandboxStatus": null,
					"oContentType": "<string>",
					"contentType": "<string>"
				}
			],
			"completelyRewritten": false,
			"id": "<string>",
			"QID": "<string>",
			"GUID": "<string>",
			"sender": "<string>",
			"recipient": [
				"<string>"
			],
			"senderIP": "<string>",
			"messageID": "<string>"
		},
		{
			"spamScore": 0,
			"phishScore": 1,
			"threatsInfoMap": [
				{
					"threatID": "<string>",
					"threatStatus": "<string>",
					"classification": "<string>",
					"detectionType": "<string>",
					"threatUrl": "<string>",
					"threatTime": "2007-01-19T00:29:50.867Z",
					"threat": "<string>",
					"campaignID": null,
					"actors": [],
					"threatType": "<string>"
				}
			],
			"messageTime": "2007-10-24T18:53:29.778Z",
			"impostorScore": 1,
			"malwareScore": 1,
			"cluster": "<string>",
			"subject": "<string>",
			"quarantineFolder": null,
			"quarantineRule": null,
			"policyRoutes": [
				"<string>",
				"<string>"
			],
			"modulesRun": [
				"<string>",
				"<string>"
			],
			"messageSize": 91423,
			"headerFrom": "<string>",
			"headerReplyTo": null,
			"fromAddress": [
				"<string>"
			],
			"ccAddresses": [],
			"replyToAddress": [],
			"toAddresses": [
				"<string>"
			],
			"xmailer": null,
			"messageParts": [
				{
					"disposition": "<string>",
					"sha256": "<string>",
					"md5": "<string>",
					"filename": "<string>",
					"sandboxStatus": null,
					"oContentType": "<string>",
					"contentType": "<string>"
				}
			],
			"completelyRewritten": true,
			"id": "<string>",
			"QID": "<string>",
			"GUID": "<string>",
			"sender": "<string>",
			"recipient": [
				"<string>"
			],
			"senderIP": "<string>",
			"messageID": "<string>"
		}
	]
}

Workflow Library Example

List Delivered Messages with Proofpoint Tap and Send Results Via Email

Preview this Workflow on desktop