- Adding Proofpoint work around in the email forensics action. Proofpoint data sometimes points to the wrong clicker of a url. (#764)

Author: scottbrumley

Packs/soc-optimization-unified/Lists/SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json

@@ -561,7 +561,7 @@
       "Proofpoint TAP v2": {
         "command": "proofpoint-get-forensics",
         "inline_args": {
-          "threatId": "${SOCFramework.Email.threat_id}",
+          "threatId": "${issue.proofpointtapthreatid}",
           "campaignId": "${SOCFramework.Email.campaign_id}",
           "includeCampaignForensics": "true"
         },