From 8f5ddce4b4ace5896973b1d54340130ee1c68c23 Mon Sep 17 00:00:00 2001
From: scottbrumley <scott@nsisecure.com>
Date: Thu, 9 Apr 2026 11:09:44 -0400
Subject: [PATCH] - Adding Proofpoint work around in the email forensics
 action.  Proofpoint data sometimes points to the wrong clicker of a url.

---
 .../SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Packs/soc-optimization-unified/Lists/SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json b/Packs/soc-optimization-unified/Lists/SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json
index b35be659..23b6ac97 100644
--- a/Packs/soc-optimization-unified/Lists/SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json
+++ b/Packs/soc-optimization-unified/Lists/SOCFrameworkActions_V3/SOCFrameworkActions_V3_data.json
@@ -561,7 +561,7 @@
       "Proofpoint TAP v2": {
         "command": "proofpoint-get-forensics",
         "inline_args": {
-          "threatId": "${SOCFramework.Email.threat_id}",
+          "threatId": "${issue.proofpointtapthreatid}",
           "campaignId": "${SOCFramework.Email.campaign_id}",
           "includeCampaignForensics": "true"
         },