Please enable JavaScript.

Coggle requires JavaScript to display documents.

PROOFPOINT - Coggle Diagram

- - - - Focus:
        
        Users at risk (mail with threat is received and is in their mailbox)
        
        Users impacted - users who clicked malicious link
        
        Users Intended: users targeted by threat but were succefully protected by TAP
        
        Spread: amount of other PP customers who received the same threat
        
        Severity: potential impact
    - - Focus:
        
        Index:overall threat burden for this user (VAP)
        
        Max threat severity: highest serverity of all threats experienced by this user
    - - URL Decoder
      - Report Threats (for false positives)
      - Custom blocklist (URL)
- - - - MODULES
        
        Email Firewall (connection and envelope)
        
        Virus Protection
        
        Spam Detection
        
        Regulatory Compliance (privacy related regulations)
        
        Digital Assets Module (confidential company information, trade secrets)
        
        Targeted Attack Protection (TAP) - URL Defense, Attachment Defense, and the Dashboard)
        
        DLP
    - - System
        
        global settings
        
        users
        
        logs
        
        quarantine
        
        smart search
        
        policy routes
      - Email Protection - inbound threats
        
        firewall
        
        authentication
        
        spam protection
        
        virus protection
        
        fraud defense
        
        TAP
      - Information Protection - outbound protection
        
        encryption
        
        digtial assets
        
        secure share
        
        regulatory compliance
        
        DLP
      - PPS filters (inbound)
        
        Email filtering (restict some contatcs to users or groups /depts)
        
        Recipient Verification (if user exists)
        
        User's safelists / blocklists
        
        Digest (End User Services)
        
        send user daily notifications about blocked / quarantined emails (and possibity to release them)
        
        link to selfservice portal to edit safe/blocks lists
        
        Email warning TAGs (INBOUND)
        
        Informational (grey)
        -- external sender
        -- untrusted sender
        
        Warnign Tags (yellow)
        -- may be impostor
        -- fake links
        -- domain is new (freshly created)
        -- sender identity cannot be verified (DMARC auth)
        -- message may be undafe
        
        TAG precedence
        
        only single TAG can be added
        
        when multiple warnings, choose the highest risk as TAG
    - - Policy Routes provide a way to group connection and envelope attributes into conditions.
    - - Rule Settings
        
        ID
        
        Description
        
        Enabled/Disabled
      - Dispositions
        
        Delivery methods
        
        continue
        
        deliver now
        
        reject
        
        discard
        
        Delivery options
        
        change header
        
        redirect
        
        delete attachmnets
        
        send a copy...
  - - - For example, if a message triggers rule A that immediately discards it, you would expect no more filtering to take place on the message. This is true as long as rule A does not have the Quarantine option selected. If the same rule A does have the Quarantine option selected, the message will continue to be filtered by all of the other filtering modules. If any other rules are triggered, the final delivery disposition of the original message is determined by the processing precedence and action precedence on the message.
  - - - SPF
        Sender Policy Framework
        
        MX record in DNS to verify sender IP
      - DKIM
        DomainKeys Identified Mail
        
        asynchronized cryptography for digital signature
        
        private and public key pair
        
        sender creates a hash of msg and encrypts it with private key -this is the DIGITAL SIGNATURE
        
        receiving server retrieves public key of sender from it's DNS and decrypts message
        
        receiving server hashes the message with algorithm specified in DIGITAL SIGNATURE and compares hashes to check integrity
      - DMARC
        Domain Based Message Authentication Reporting and Conformance [SPF & DKIM PASS]
        
        check SPF and DKIM if the pass AND checks
        identifier alignment
        
        identifier alignment:
        DMARC checks if mail-from field in ENVELOPE matches mail-from field in HEADER
        
        DMARC also checks if domain in mail-from HEADER matches domain in DIGITAL SIGNATURE field
- - - - Analyzer - process
        
        Threat Analysis (AUTO) components
        
        Proofpoint Threat Intelligence (maybe there's update because MSG was scanned there in INBOUND)
        
        TAP sandbox (URLs and Attachmnets)
        
        Threat Analyst Rulesets
        
        Machine Learning
        
        Verdict (Disposition)
        
        Bulk
        
        Low risk
        
        SPAM
        
        Malicious
        
        Suspicious
        
        Unknown
        
        UNKNOWN (for manual review) - assume to be CLEAN
        Reasons:
        
        message body not machine readable (image)
        
        contains PII information (personaly identifiable)
        
        sender is whitelisted
        
        Incident Response (Manual)
        
        Only Suspicous and Unknown dispositions
        
        Abuse Mailbox Monitor
        
        TRAP queries Analyzer for Disposition verdict based on CLEAR ID
        
        Creates incident and alert
        
        AutoClose incidents which are Bulk, Low Risk, SPAM or Malicious
        
        Close the Loop
        
        notify EndUser with Template about final disposition for the MSG user reported
- - - - Sources
        
        source of alerts to feed/update TRAP
        
        ProofPoint TAP
        
        Abuse Mailbox Monitor (part of CLEAR solution)
        
        Smart Search
        
        CSV imports
      - TRAP uses ServiceAccount in O365 to move/restore messages from users mailbox to Quarantine
      - Manual PULLs
        
        A manual pull refers to the process of manually uploading a comma-separated-values (CSV) file into an event source in TRAP. CSV files can be
        
        A manual pull is the process of manually uploading a CSV file into an event source to create alerts in TRAP. Using match conditions, TRAP can respond to the alert and pull and quarantine specific messages based on the information in the CSV file.
        
        Based on CSVs:Exported from Proofpoint
        Smart Search
        
        Using match conditions, TRAP is able to detect and pull malicious messages from user mailboxes, and then quarantine them based on the information in the CSV file.
        
        Smart Search (external to internal)
        
        CSV upload
        (internal to internal)
        
        create a new empty INCIDENT
        
        import CSV from within INCIDENT -
        
        upload CSV result of Smart Search to Quatrantine messages
  - - - used by PhishAlarm Analyzer
- - - - Permitted click - rewritten URL was clicked before it was condemned
      - Unprottected URL - malicious URL was not rewritten when delivered
  - - - When Abuse Mailbox message received
      - When CLEAR analysis is completed
    - - When TAP Alert is Received
      - When TAP Cleared or False Positive Alerts are Received
      - When Smart Search Import is Received
    - - When message quarantine is completed
      - When message restore is completed
    - - When an Incident is Created or Modified
      - When an Incident is Opened
      - When an Incident is Closed