TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| Proofpoint Security Awareness Phishing Simulation Events | ✅ | proofpoint_security_awareness_phishing_events | JSON | API |
Overview
Proofpoint Security Awareness and Education (formerly Wombat Security, also known as ZenGuide/securityeducation.com) is a security awareness training platform that runs simulated phishing campaigns against an organization's employees to measure susceptibility and reinforce safe behavior. The Phishing endpoint of the Results API returns per-user, per-event records of simulated phishing campaign activity — for example whether a user viewed, clicked, reported, or submitted data to a simulated phishing email, as well as whether follow-up "teachable moment" training was sent and completed. These logs are valuable for security operations because they reveal which users are most susceptible to phishing (clicked, submitted data, no action) versus security-aware (reported), enabling risk-based training targeting, phishing-awareness metrics, and identification of users who may need additional controls or monitoring. Each record ties a specific user identity to a specific simulated campaign/template and a precise event timestamp, supporting trend analysis of organizational phishing resilience over time. Integrating this data into Hunters allows security teams to correlate human-risk indicators with other telemetry for a more complete picture of organizational exposure.
Supported data types
Proofpoint Security Awareness Phishing Simulation Events
Table name: proofpoint_security_awareness_phishing_events
This data type contains per-user, per-event records from simulated phishing campaigns, including the campaign and template used, the user's action (such as reported, clicked, attachment opened, or no action), and relevant timestamps for when the simulated email was sent and when the user acted on it. It covers phishing-awareness and human-risk events rather than actual malicious activity, supporting analysis of employee susceptibility to phishing over time.
Expected format
Logs are expected in JSON format.
{"type":"api_attack_events","id":2328759773,"attributes":{"userfirstname":"Laura","userlastname":"Simmons","useremailaddress":"laura.simmons@example.com","useractiveflag":true,"userdeleteddate":null,"senttimestamp":"2020-02-20T18:57:20","eventtimestamp":"2020-02-20T19:06:26","eventtype":"Reported","campaignname":"2020-02-11 -Custom OneDrive 0% - ORG","autoenrollment":false,"campaignstartdate":"2020-02-11T16:00:00","campaignenddate":"2020-02-28T01:00:07","campaigntype":"Drive By","campaignstatus":"Completed","templatename":"Deactivation of old OneDrive Account","templatesubject":"Deactivation of old OneDrive Account","assessmentisarchived":false,"usertags":null,"sso_id":"Unknown"}}
Send data to Hunters
Hunters supports the collection of Proofpoint logs using API.
To connect Proofpoint logs:
Connect using API
- In the Proofpoint Security Awareness Training portal, generate a Results API token (via the account's Token Mart / API settings) with read access to phishing simulation results, and note the regional Results API host associated with your account, following Proofpoint's own Security Awareness Training Results API documentation.
- Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.