What does a notification of “Cleared” mean when shown in the header of an individual threat tab?

Within the Proofpoint TAP Dashboard, the "Cleared" status in a threat's header indicates that the threat has been fully remediated and is no longer considered an active risk to the organization. This status typically signifies that a malicious email was removed from users' inboxes via features like Threat Response Auto-Pull (TRAP), or that a malicious URL has been blocked and any associated risks have been mitigated. It represents the successful conclusion of the incident response process for that specific threat.

A. The threat has been detected but hasn’t been resolved yet: This status would be indicated by a label such as "Active" or "Processing," not "Cleared."

C. The threat has been identified but is not considered a priority for investigation: This would be represented by a priority level (e.g., Low) rather than a resolution status like "Cleared."

D. The threat has been temporarily contained but may still pose a risk: This status is better described as "Quarantined" or "Contained," implying the threat is isolated but not fully resolved.

Proofpoint TAP Administration Guide. (2023). Chapter: "Using the TAP Dashboard," Section: "Viewing Threats." The documentation defines the threat states, specifying that "Cleared" means "The threat has been remediated and is no longer active."