Partnership Overview
Proofpoint and SentinelOne connect human-centric email threat detection with autonomous endpoint protection, so a malicious attachment caught in the inbox is also detected and contained on your endpoints. Since 2022, Proofpoint Core Email Protection (TAP) has shared the indicators of files it condemns after delivery with SentinelOne Singularity XDR, which detects the same file on any protected device, even if it arrives by a route other than email. Joint customers get this protection without deploying a new platform.
Inbox verdicts become endpoint controls
Files TAP condemns after delivery are shared with SentinelOne through the TAP API and matched by a Storyline Active Response (STAR) rule on protected endpoints.
Automatic containment, no manual handoff
When SentinelOne finds the file, the endpoint group's policy drives the response: kill the process, quarantine, remediate, and roll back. No analyst has to copy hashes by hand.
Layered protection with licenses you already hold
Joint customers get a second control on the same threat using the TAP and SentinelOne licenses they already hold, with no new platform to deploy or staff.
Email-Borne Threats
Email remains one of the most common ways attackers gain an initial foothold, and the global average cost of a data breach reached $4.99M in 2026, according to IBM. Once a malicious file reaches a device, adversaries move quickly to execute and spread. Siloed email and endpoint tools miss the connection between those events, giving attackers the time they need to do damage.
Post-Delivery Intelligence
|
When Proofpoint Core Email Protection (TAP) identifies a malicious attachment after delivery, SentinelOne Singularity XDR retrieves the file's indicators through the TAP API. A STAR rule on the Proofpoint indicator source then flags that file as a threat if it appears on any SentinelOne-protected endpoint. |
Post-Delivery Detection
TAP identifies malicious attachments after delivery and makes the condemned file indicators available through the TAP API.
Singularity Marketplace Module
A single TAP API credential in the Proofpoint module of the Singularity Marketplace lets SentinelOne retrieve condemned indicators automatically.
STAR Rule Matching
A STAR rule matches the shared file hashes and treats a match as a threat, including when the file arrives by a route other than email.
Automated Response
When SentinelOne finds a condemned file on an endpoint, the policy for that endpoint's group drives the response. Teams can add custom controls to contain the threat further, without waiting for an analyst to copy indicators between tools.
Policy-Driven Response
Kill the process if the file has executed, quarantine it, remediate, and roll back, based on the endpoint group's policy.
Custom Response Controls
Add the hash to a watchlist or STAR rule, network-isolate the endpoint, or move it to a different policy group.
No Manual Hash Handoff
Indicators move from TAP to SentinelOne through the API, so no analyst has to re-enter file hashes in the endpoint console.
Request a Demo
Thank you!
A Proofpoint cybersecurity specialist will reach out to you shortly.
Recommended for You
Proofpoint Core Email Protection (TAP) identifies a malicious email attachment after delivery. SentinelOne Singularity XDR retrieves the file's indicators through the TAP API, and a Storyline Active Response (STAR) rule detects the file on any protected endpoint. Depending on the endpoint group's policy, SentinelOne can kill the process, quarantine the file, remediate, and roll back.
Email security identifies and stops threats in the mail flow but can't contain a file once it reaches a device. Endpoint security can contain files but has no native knowledge of which attachments Proofpoint has already condemned. Together, a verdict made in the inbox becomes a control on the endpoint.
|
A threat caught in the inbox is contained on the endpoint. A file Proofpoint condemns is automatically detected and contained by SentinelOne on protected devices, using licenses joint customers already hold. |
You need Proofpoint Email Protection (PPS or PoD) with TAP and Attachment Defense, plus a TAP API credential. On the SentinelOne side, you need SentinelOne Complete with STAR enabled in Deep Visibility and the Proofpoint module configured in the Singularity Marketplace. Confirm licensing with both vendors before you begin.
Proofpoint shares indicators for files it has condemned after delivery. The flow is one way, from Proofpoint to SentinelOne. The integration acts on endpoints; clean-up of messages in mailboxes is handled by Proofpoint's own remediation capabilities.
