Grafana MarketplaceCommercial Plugin

Proofpoint TAP Plugin for Grafana

Monitor email threat protection events in Grafana

Get the Plugin Talk to an Expert

Built for

TAP event categories

Pre-built dashboards

Agents or exporters required

≥ 12.3

Grafana version supported

Overview

Monitor Proofpoint TAP email threats directly inside Grafana

Proofpoint SIEM API

Basic Auth (Service Principal)

Four TAP event categories

Single pane of glass

The Proofpoint TAP plugin is a backend data source plugin that enables on-demand querying and visualization of Proofpoint Targeted Attack Protection (TAP) SIEM events inside Grafana panels, using the native Proofpoint SIEM API. Security and email operations teams get email-threat visibility in the same dashboards they already use for the rest of their stack.

Proofpoint TAP helps organizations identify, prevent, and respond to sophisticated email-based attacks targeting their users, analyzing email traffic to surface threats across all communications. The plugin brings permitted and blocked URL clicks and delivered and blocked messages into Grafana, so teams can track threat classifications, monitor threat status, identify top senders, and investigate campaigns from a single pane of glass, without logging into a separate console.

Coverage

What You Can Monitor

The plugin queries Proofpoint TAP SIEM events across four categories, selectable by event type, threat status, and threat type in the query editor.

01 — Clicks

Click Events

Track Clicks Permitted and Clicks Blocked to see when users clicked URLs that TAP allowed or intercepted. Break clicks down by threat classification and threat status to understand which campaigns are reaching users and how effectively malicious links are being stopped.

02 — Messages

Message Events

Monitor Messages Delivered and Messages Blocked to see how email threats are handled at the gateway. Filter by threat type (URL, attachment, or message text) and threat status, review average threat scores, and identify the top senders driving threat volume.

See It in Grafana

Set up and query, right inside Grafana

Configure the data source with your Proofpoint credentials, then build threat-event queries in a guided editor. The plugin also ships with three pre-built dashboards — TAP Overview, Messages Analysis, and Clicks Analysis.

1 / 2

Data Source Configuration

Enter your Proofpoint TAP Service Principal and Secret, then Save & test.

Query Editor

Pick an event type — clicks or messages — filter by threat status and type, and choose the columns to return.

Differentiators

Why Crest Data's Proofpoint TAP Plugin?

Native & Agentless

Talks directly to the Proofpoint SIEM API with Service Principal and Secret authentication from the Go backend. No agents, no exporters, no extra collection layer to deploy or maintain.

Four Event Categories

Query Clicks Permitted, Clicks Blocked, Messages Delivered, and Messages Blocked, or all together, for complete visibility into email-borne threats and how TAP acted on them.

Rich Threat Filtering

Filter by threat status (active, cleared, false positive) and threat type (URL, attachment, message text), and choose which fields to return, so analysts see exactly the events that matter.

Built for the SIEM API

Automatic time-range chunking splits larger windows into compliant one-hour requests and merges the responses, handling Proofpoint's API constraints transparently.

Resilient by Design

Built-in retry with exponential backoff for transient failures (429, 5xx, and connection errors), with clear, immediate errors for authentication issues.

Fast Time-to-Value

Ships with three pre-built dashboards for overview, message analysis, and click analysis, so teams get immediate insight into email threat data without building panels from scratch.

Built and Maintained by Crest Data

Developed and proactively maintained by Crest Data as a commercial Grafana Marketplace plugin, with continuous compatibility as the Proofpoint API evolves.

How to Get the Plugin