The below configuration guides will explain how to create a custom BlueApp to collect events from Proofpoint Targeted Attack Protection. Once the app is working, don't forget to create a rule if you would like to get alarms in response to specific events.

There are multiple apps depending on the type of logs you are seeking.

Proofpoint Targeted Attack Protection Blocked Clicks: Proofpoint-BlockedClicksConfigurationGuide.pdf

Proofpoint Targeted Attack Protection Delivered Messages: Proofpoint-DeliveredMessagesConfigurationGuide.pdf

Proofpoint Targeted Attack Protection Permitted Clicks: Proofpoint-PermittedClicksConfigurationGuide.pdf

Proofpoint Targeted Attack Protection Messages Blocked: Proofpoint-MessagesBlockedConfigurationGuide.pdf