[PROOFPOINT] Spam Classification Messages ClicksBlocked

alert any $HOME_NET any -> $HOME_NET any (msg:"[PROOFPOINT] Spam Classification Messages ClicksBlocked"; program:proofpoint_siem_api_data; content:"classification
| 22 3a 20 22
| spam"; nocase; content:!"spamScore
| 22 3a 20
| 0"; content:"event_type
| 22 3a 20 22
| clicksBlocked"; reference:url,ptr-docs.proofpoint.com/extensibility-guides/ptr-api/?shell; reference:url,help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API; classtype:trojan-activity; sid:5010922; rev:2; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_06, updated_at 2026_05_04, mitre_tactic_id TA0001, mitre_technique_id T1566;)