Proofpoint TAP Review
June 21, 2019
Proofpoint TAP Review
Score 8 out of 10
Vetted Review
Verified User
Overall Satisfaction with Proofpoint Targeted Attack Protection for Email
Proofpoint TAP is used as part of our email security strategy. Inbound emails are scanned by TAP for malicious attachments, links, and other indicators of compromise. Proofpoint TAP logs feed into our SIEM for investigation and correlation against other log data. TAP can also be used to input IOCs like URLS so that the emails are blocked before entering the environment. Today we receive two types of alerts from TAP, one lets you know that Proofpoint now recognizes this email to be malicious and the analysts can investigate and remediate. The second type of alert is that an individual has clicked on a link that is known bad. Then the analysts can search logs for if the user successfully made it to the website and input any data.
- Block malicious and phishing emails
- Alert of now known to be bad emails
- Threat intelligence for tracking campaigns
- Metrics and dashboards around email activity
- Ability to block additional IOCS instead of just URL
- Ability to integrate with threat intelligence platforms
- What they label as a false positive is not always a false positive
- It has had a positive impact of reducing the time it takes to investigate bad emails
- It has provided meaningful metrics and dashboards for leadership
- It has provided meaningful log data to feed into the SIEM for correlation
I have used Microsoft EOP and O365 ATP for email security. I have also used the FireEye Email Security platform for inline inspection and blocking of malicious emails. Proofpoint is better than the Microsoft products as a whole but FireEye catches things that neither of the tools do today. FireEye also integrates with other FireEye platforms and has a better ability to add in IOCs for blocking.