WitFoo-Artifact ::: tags=["title=CPB - Failed Suspicious Login","description=Failed Suspicious Login Has Been Detected","detail=undefined"] ::: action=blocked ::: message={"id":"38e222202d0b93aefaf74ce87292f0c9","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1703881856536,"severity":"LOW","title":"CPB - Failed Suspicious Login","description":"Failed Suspicious Login Has Been Detected","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"b25e664e3cb09a69a78795ebca7766e8","cloud_service":"Office 365","timestamp":1703881357000,"user_id":"user_1c4fc0dc6647d32f789049fdccfbe4a0","user_email":"alice","full_name":"Monica Elizabeth Navarro","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36","location":"Korea (Republic of), Gyeonggi-do, Suwon","geo_location":[127.0163345336914,37.26679229736328],"intelligence":[{"ip_address":"208.38.90.144"}],"event_classification":{"id":"9852","category":"Suspicious Login","sub_category":"Suspicious Login","threat":"Authentication"},"meta_data":{"extracted_fields":[{"129064":"[\"50\"]"},{"129065":"[\"Failure\"]"},{"129067":"[\"Suspicious login attempt detected for alice, from Bruteforcer 208.38.90.144 (KT Corporation) \\n\\nThreat intelligence: \\nProofpoint CASB | IP Last Seen On: 2023-12-29\\nProofpoint CASB | Categories: Bruteforcer\\nIP Enrichments | Usage Type: ISP/MOB\\nIP Enrichments | Domain: kt.com\"]"},{"129068":"[\"Low\"]"}]}}]} ::: program=Office 365 ::: clientIP=208.38.90.144 ::: userName=alice ::: geoRegion=Korea (Republic of), Gyeonggi-do, Suwon ::: created_at=1703881856536 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch
Product: CASB
Vendor: ProofPoint