WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"f2728cafb7ced6260408bbb1446eeb72617ecfb1f455413e4a1d1f4eb7db3659","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f2728cafb7ced6260408bbb1446eeb72617ecfb1f455413e4a1d1f4eb7db3659","threatTime":"2023-10-27T14:09:40.000Z","threat":"https://website6005958.nicepage.io/Home.html","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-27T14:30:55.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"Microsoft-365 Restricted","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":1754,"headerFrom":"Admin <afh@eagle.ca>","headerReplyTo":"zixcorp800@gmail.com","fromAddress":["afh@eagle.ca"],"ccAddresses":[],"replyToAddress":["6befb4053775750292a7558ed0d73812@gmail.com"],"toAddresses":["afh@eagle.ca"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"7248e88388208885cd8a194d3413df39bf9ce5138ce201ad81c2183e354cb54a","md5":"73a156f197b9b5b719b6bde1634aff08","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"fa8fcfc4-7dd2-e300-ee8e-e08d19af7a26","QID":"3tyws58b57-1","GUID":"wKksu9Dh95Aloz74OYAkkbJ73qMYefiA","sender":"afh@eagle.ca","recipient":["treasurymanagement@oscorp.bank"],"senderIP":"74.118.115.6","messageID":"<3tyws58b57-1@m0162926.ppops.net>"} ::: fileHash=<3tyws58b57-1@m0162926.ppops.net> ::: fileName=from: afh@eagle.ca subj: Microsoft-365 Restricted ::: serverIP=74.118.115.6 ::: emailFrom=afh@eagle.ca ::: created_at=2023-10-27T14:30:55.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Microsoft-365 Restricted ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-27T14:30:55.000Z ::: emailSendingServer=74.118.115.6 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "afh@eagle.ca",
    "emailsendingserver": "208.70.104.203",
    "emailsubject": "Microsoft-365 Restricted",
    "filehash": "<3tyws58b57-1@m0162926.ppops.net>",
    "filename": "from: afh@eagle.ca subj: Microsoft-365 Restricted",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"f2728cafb7ced6260408bbb1446eeb72617ecfb1f455413e4a1d1f4eb7db3659\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f2728cafb7ced6260408bbb1446eeb72617ecfb1f455413e4a1d1f4eb7db3659\",\"threatTime\":\"2023-10-27T14:09:40.000Z\",\"threat\":\"https://website6005958.nicepage.io/Home.html\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-10-27T14:30:55.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"oscorp_hosted\",\"subject\":\"Microsoft-365 Restricted\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":1754,\"headerFrom\":\"Admin <afh@eagle.ca>\",\"headerReplyTo\":\"zixcorp800@gmail.com\",\"fromAddress\":[\"afh@eagle.ca\"],\"ccAddresses\":[],\"replyToAddress\":[\"6befb4053775750292a7558ed0d73812@gmail.com\"],\"toAddresses\":[\"afh@eagle.ca\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"7248e88388208885cd8a194d3413df39bf9ce5138ce201ad81c2183e354cb54a\",\"md5\":\"73a156f197b9b5b719b6bde1634aff08\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"}],\"completelyRewritten\":false,\"id\":\"fa8fcfc4-7dd2-e300-ee8e-e08d19af7a26\",\"QID\":\"3tyws58b57-1\",\"GUID\":\"wKksu9Dh95Aloz74OYAkkbJ73qMYefiA\",\"sender\":\"afh@eagle.ca\",\"recipient\":[\"treasurymanagement@oscorp.bank\"],\"senderIP\":\"74.118.115.6\",\"messageID\":\"<3tyws58b57-1@m0162926.ppops.net>\"} ::: fileHash=<3tyws58b57-1@m0162926.ppops.net> ::: fileName=from: afh@eagle.ca subj: Microsoft-365 Restricted ::: serverIP=74.118.115.6 ::: emailFrom=afh@eagle.ca ::: created_at=2023-10-27T14:30:55.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Microsoft-365 Restricted ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-27T14:30:55.000Z ::: emailSendingServer=74.118.115.6 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-27T14:30:55.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "74.118.115.6"
}