• 1 Minute to read
  • PDF


  • PDF

About this document

This document provides a step-by-step procedure to configure the Proofpoint Targeted Attack Protection (TAP) in SAFE. 


The SAFE - Proofpoint integration helps you measure employee behavior more effectively. This integration allows SAFE to pull the threat intel details on the employees of your organization. It includes the details such as the Threat index, VAP (Very attacked person), VIP, and Top Clickers. 

Using Proofpoint service credentials and a secret key, you can configure Proofpoint in SAFE from SAFE Hooks.


You need the following connector details:

  • Service Credential
  • Secret Key

 Refer to Proofpoint TAP documentation to generate the service credential.

Configure Proofpoint

Follow the below step-by-step procedure to configure Proofpoint in SAFE:

  1. Navigate to the SAFE Hooks.
  2. On the Proof point configuration page, enter the Service Credential and Secret Key.
  3. Click the Test Connection button.
  4. Once the connection is validated, click the Save button. The system automatically enables the Proofpoint TAP toggle button.

  • Once the connection is established, SAFE syncs with Proofpoint once every 24 hours to fetch the threat intel details of users.
  • You can trigger the on-demand sync by clicking the Sync Now button available on the Proofpoint configuration page.
  • The employee's SAFE Score will only be impacted by the threat intel data if the system receives new threat intel data in the last five days.

View Threat intel data (Proofpoint) on SAFE

Once Proofpoint is configured in SAFE, it displays the Threat Analytics of users on the Users details page available under People. 

To view the Threat Analytics for a user:

  1. Navigate to People > Users.
  2. Click the user from the list to open the user's details page. The Proofpoint TAP section on the user's details page displays the details such as Threat Index, VIP, and VAP.
  3. Click the Threat Analytics tab. The threat Analytics tab shows details such as Threat Families, Number of clicks, and Threat Score.

Was this article helpful?

What's Next