Proofpoint Threat Response Auto-Pull

Email quarantine for malicious and unwanted messages, after delivery

Unwanted email can take several forms. Malicious emails can contain phishing links that can be poisoned after delivery or use evasion techniques which lead to false negatives and delivered malicious emails. Unwanted email such as inappropriate jokes or compliance violations in emails are a few examples. Email security teams are often tasked with email analysis and cleaning up to reduce threat exposure and limit potential damages. While email quarantining one message may not require much work and a mere 10 to 15 minutes each, situations where ten emails or more are involved can become tedious, with time requirements quickly adding up.

Forward following and distribution list expansion

Malicious and unwanted emails may be forwarded to other individuals, departments, or distribution lists. In these situations, attempting to retract those emails after delivery has been a sore point for many administrators. Threat Response Auto-Pull (TRAP) addresses this situation with built-in business logic and intelligence that understands when messages are forwarded or sent to distribution lists then automatically expands and follows the wide fan out of recipients to find and retract those messages. This saves time and frustration, and with the added benefit of showing message 'read' status, TRAP additionally helps prioritize which users and endpoints to review.

Out-of-band email management

TRAP also leverages CSV files, PPS SmartSearch, and abuse mailboxes. Users can upload SmartSearch results, CSV files or use manual incidents with a few key pieces of information to initiate an email quarantine action of one or thousands of emails. In moments, policy violating emails, in addition to security threats can be pulled out of mailboxes, with an activity list showing who read the emails and the success or failure of the attempt to recall the email.

Cross-vector intelligence sharing with the Proofpoint Nexus Threat Graph

The Proofpoint Nexus Threat Graph provides industry-leading aggregation and correlation of threat data across email, cloud, network and social. It powers real-time threat protection and response across all Proofpoint products. And as part of the Proofpoint Platform, there is nothing to install, deploy or manage. Threat Response Auto-Pull (TRAP) leverages the Nexus Threat Graph intelligence to build associations between recipients and user identities. It reveals associated campaigns and surfaces IP addresses and domains in the attack. And based on that, TRAP takes automated actions on targeted users who belong to specific departments or groups with special permissions.

• Email quarantine for malicious and unwanted messages, after delivery
• Forward following and distribution list expansion
• Out-of-band email management
• Cross-vector intelligence sharing with the Proofpoint Nexus Threat Graph

MPN: PP-M-AP-V-C-105