#1 most frequent
United States of America
85.7%114 installations of 133
What is Proofpoint Threat Response Auto-Pull?
Proofpoint Threat Response Auto-Pull (TRAP) enables messaging and security administrators to automatically retract threats delivered to employee inboxes and emails that turn malicious after delivery to quarantine. It is also a powerful solution to retract messages sent in error as well as inappropriate, malicious, or emails containing compliance violations and also follows forwarded mail and distribution lists and creates an audit-able activity trail.
Categories & Use Cases
Top Performing Features
Live Response for Rapid Remediation
Live remediation response allows incident responders to initiate remediation from anywhere over secure connection
Category average: 8.3
Integration with Other Security Systems
Pre-built integration with other security systems like SIEM and threat intelligence
Category average: 7.5
Machine Learning to Prevent Incidents
Incident prevention powered by machine learning with no human intervention
Category average: 8.8
Areas for Improvement
Attack Chain Visualization
Attack chain visualization to help identify root cause
Category average: 6.5
Centralized Dashboard
A central dashboard provides analysts with a clear look at the most important data
Category average: 8.5
Who Buys & Uses Proofpoint Threat Response Auto-Pull
#2 most frequent
Canada
3.0%4 installations of 133
#3 most frequent
France
2.3%3 installations of 133
Very happy with my TRAP appliance
Pros
- It will automatically pull malicious emails from users' mailboxes if they are not detected first by PPS.
- It will evaluate user-submitted suspect phishing emails and reply to the users with the result of the evaluation.
- It will pull emails from users per an admin-submitted CVS file of emails we want to pull.
- It informs admins of the status of its email investigations.
Cons
- Would like an Azure virtual machine version of it. Currently, it's only supported on VMware and AWS.
- Configuring authentication certificates on it is not easy.
- It does not work with RSASSA-PSS signed certificates.
Return on Investment
- Saves email admins approximately 10 hours per week from manually investigating and pulling malicious emails.
- With auto-response templates, it teaches users how to better react to suspicious emails.
- If one user submits a malicious email, it will auto pull the same email from the others affected users. That's great for preventing further outbreaks.
Alternatives Considered
Microsoft Exchange
Other Software Used
Proofpoint Advanced Threat Protection, Proofpoint Cloud App Security Broker (Proofpoint CASB), Proofpoint Email Protection, Proofpoint Security Awareness Training (formerly Wombat Security)
Usability
Proofpoint TRAP - Pull malicious emails
Pros
- Automatically pulling malicious emails from users inboxes.
- Low admin intervention.
- Reducing remediation time on malicious emails.
Cons
- Learning curve is steep.
- Interface can be clunky.
- Some interface items seem counter-intuitive.
Return on Investment
- Helped mitigate the email portion of our penetration test entirely.
- Made us aware of the amount of suspicious emails being delivered.
- Prevented malware spreading through mail.
Other Software Used
Proofpoint Advanced Threat Protection, Proofpoint Email Protection
Excellent last-defense for malicious email
Pros
- Auto pull works great, even with our hybrid situation with 2 on premise exchange organizations.
- Reporting is good, nice graphs of all the actions.
Cons
- As threat response auto-pull uses a subset of the full threat response product, the GUI is too bloated.
- It is still only an on premise VM, still waiting for a cloud version.
Return on Investment
- Chances of phishing attacks has decreased.
- Your employees don't have to do anything, so no impact on productivity.
TRAP helps me sleep at night
Pros
- Finds malicious messages in users mailboxes that were not previously detected.
- Gives good data about messages post-detection.
- Integrates with AD.
Cons
- Removing messages from mailboxes manually requires uploading a CSV in a particular format. More flexibility here would be great.
Return on Investment
- Streamlined IR processes
- Gives the Exchange team more free time since they don't have to participate in IR activities as frequently
