The "Create Torq Cases from Proofpoint Clicks Permitted" workflow automates the process of managing suspicious user activity within an organization's network. When scheduled to run, it checks for recently allowed clicks via Proofpoint and investigates the related URLs using VirusTotal. If potential threats are identified, the workflow generates detailed Torq cases, tagging them appropriately based on the nature of the threatâwhether malicious, suspicious, or phishing. This enables teams to respond swiftly to security incidents, streamlining incident response and bolstering the organization's cyber defense mechanisms.
Use Cases
Suspicious User Activity
Workflow Breakdown
Check for the previous execution and calculate a new start time period
Query Proofpoint for any clicks permitted in the time period
If a click is found enrich the URL in VirusTotal
Open a new Torq case and add any VirusTotal summary information and tag the case with relevant findings.
Vendors
Utils, VirusTotal, Torq, Torq Cases, Proofpoint
Workflow Output
New Torq cases based on Proofpoint Clicks Permitted.