Exploring the Proofpoint Integration for Security Operations

---
title: Exploring the Proofpoint Integration for Security Operations
description: You can configure event profiles in SIR to ingest events from Proofpoint. SIR creates an incident for each ingested event which analysts can review or work on.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/proofpoint-integration-secops-exploring.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Proofpoint Integration for Security Operations, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Exploring the Proofpoint Integration for Security Operations

You can configure event profiles in SIR to ingest events from Proofpoint. SIR creates an incident for each ingested event which analysts can review or work on.

## Proofpoint Integration for Security Operations users

<table id="table_at5_k2g_b2c"><thead><tr><th>

User

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Security admin

</td><td>

Create event profiles for filtering the ingested events. SIR creates incidents for these the ingested events.

</td></tr></tbody>
</table>## Proofpoint Integration for Security Operations benefits

<table id="table_dt5_k2g_b2c"><thead><tr><th>

Benefit

</th><th>

Feature

</th><th>

Users

</th></tr></thead><tbody><tr><td>

Pull event data into your instance and create security incidents. Review security incidents from a single location for events deemed suspicious or malicious.

</td><td>

If the delivered email messages and permitted clicks are later deemed malicious, chances are these messages were opened and interacted with by your employees. To track these messages for review, automatically create security incidents based on the event profiles you create and configure for message traffic for the integration.

 Additionally, you can also enable creating security incidents for the blocked messages and clicks for audit purposes.

</td><td>

Managers

</td></tr></tbody>
</table>## What to explore next

To learn more about configuring and using Proofpoint, see:

-   [Configuring the Proofpoint Integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/proofpoint-integration-secops-configuring.md)
-   [Review Proofpoint integration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/review-proofpoint-integration-setting-sir.md)
-   [View the Proofpoint Analytics Dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/view-proofpoint-dashboard.md)