drop proofpoint tap alert export · parse threat id + sender + url rewrite · runs locally
drop proofpoint tap alert export · local only
heuristic screener · vendor schema varies · not definitive proof