WitFoo-Artifact ::: tags=["title=CPB - Failed Suspicious Login","description=Failed Suspicious Login Has Been Detected","detail=undefined"] ::: action=blocked ::: message={"id":"f8637dbb1b457f4316d0b78139a455de","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1692047758716,"severity":"LOW","title":"CPB - Failed Suspicious Login","description":"Failed Suspicious Login Has Been Detected","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"c2e869b585d0fe6c2d42c08b29f26d81","cloud_service":"Office 365","timestamp":1692047323000,"user_id":"user_ad0c6a4ddd0da49a58117f8e0e670345","user_email":"alice","full_name":"Linda Cunningham","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 16_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko)","location":"United Kingdom of Great Britain and Northern Ireland, Wales, Victoria","geo_location":[-3.200000047683716,51.75],"intelligence":[{"ip_address":"106.195.146.6"}],"event_classification":{"id":"9852","category":"Suspicious Login","sub_category":"Suspicious Login","threat":"Authentication"},"meta_data":{"extracted_fields":[{"129064":"[\"50\"]"},{"129065":"[\"Failure\"]"},{"129067":"[\"Suspicious login attempt detected for alice, from Bruteforcer 106.195.146.6 (Free Range Cloud Ltd.) \\n\\nThreat intelligence: \\nProofpoint CASB | IP Last Seen On: 2023-08-14\\nProofpoint CASB | Categories: Bruteforcer\\nIP Enrichments | Usage Type: DCH (Data Center Host)\\nIP Enrichments | Proxy Type: DCH (Data Center Host)\\nIP Enrichments | Domain: freerangecloud.com\\n\\nBehavioral indicators for alice: \\nRare country score: High (common country: United States)\\nRare user agent score: High (common user agent: windows/10/x64/microsoft edge/112.0////)\\nRare isp score: High (common isp: San Diego Private Bank)\"]"},{"129068":"[\"Low\"]"}]}}]} ::: program=Office 365 ::: clientIP=106.195.146.6 ::: userName=alice ::: geoRegion=United Kingdom of Great Britain and Northern Ireland, Wales, Victoria ::: created_at=1692047758716 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch
Product: CASB
Vendor: ProofPoint