WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0","threatTime":"2023-06-27T18:40:42.000Z","threat":"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-06-27T18:41:53.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound","yanroute"],"modulesRun":["av","zerohour","spf","sandbox","spam","dmarc","urldefense"],"messageSize":8811,"headerFrom":"\"hr@umbrella.bank\" <a-iwama@jflc.or.jp>","headerReplyTo":null,"fromAddress":["a-iwama@jflc.or.jp"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["rsujeeth@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0","md5":"c7a29ff2c445d48639e9c6c7de5046b0","filename":"emp#43965.htm","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"093df969-646f-2063-9f75-40aadd655ff0","QID":"3rdvbt13j1-1","GUID":"-Wa9o3M8Gb77SYLClbR1c54nBk6moJKh","sender":"a-iwama@jflc.or.jp","recipient":["rsujeeth@umbrella.bank"],"senderIP":"45.74.138.48","messageID":"<77c312b0-f946-e59f-f87e-fbe8cac7e430@jflc.or.jp>"} ::: fileHash=<77c312b0-f946-e59f-f87e-fbe8cac7e430@jflc.or.jp> ::: fileName=from: a-iwama@jflc.or.jp subj: IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965 ::: serverIP=45.74.138.48 ::: emailFrom=a-iwama@jflc.or.jp ::: created_at=2023-06-27T18:41:53.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-27T18:41:53.000Z ::: emailSendingServer=45.74.138.48 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "a-iwama@jflc.or.jp",
    "emailsendingserver": "153.127.234.3",
    "emailsubject": "IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965",
    "filehash": "<77c312b0-f946-e59f-f87e-fbe8cac7e430@jflc.or.jp>",
    "filename": "from: a-iwama@jflc.or.jp subj: IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0\",\"threatTime\":\"2023-06-27T18:40:42.000Z\",\"threat\":\"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0\",\"campaignID\":null,\"threatType\":\"attumbrellament\"}],\"messageTime\":\"2023-06-27T18:41:53.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965\",\"quarantineFolder\":\"Attumbrellament Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\",\"yanroute\"],\"modulesRun\":[\"av\",\"zerohour\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":8811,\"headerFrom\":\"\\\"hr@umbrella.bank\\\" <a-iwama@jflc.or.jp>\",\"headerReplyTo\":null,\"fromAddress\":[\"a-iwama@jflc.or.jp\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"rsujeeth@umbrella.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"04ff9999ea27d4e7aa2f804661c1b623fb781598ce41593fbd0430a87c75aab0\",\"md5\":\"c7a29ff2c445d48639e9c6c7de5046b0\",\"filename\":\"emp#43965.htm\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"093df969-646f-2063-9f75-40aadd655ff0\",\"QID\":\"3rdvbt13j1-1\",\"GUID\":\"-Wa9o3M8Gb77SYLClbR1c54nBk6moJKh\",\"sender\":\"a-iwama@jflc.or.jp\",\"recipient\":[\"rsujeeth@umbrella.bank\"],\"senderIP\":\"45.74.138.48\",\"messageID\":\"<77c312b0-f946-e59f-f87e-fbe8cac7e430@jflc.or.jp>\"} ::: fileHash=<77c312b0-f946-e59f-f87e-fbe8cac7e430@jflc.or.jp> ::: fileName=from: a-iwama@jflc.or.jp subj: IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965 ::: serverIP=45.74.138.48 ::: emailFrom=a-iwama@jflc.or.jp ::: created_at=2023-06-27T18:41:53.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=IMPORTANT: EMPLOYEE MIDYEAR BENEFIT REF#43965 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-27T18:41:53.000Z ::: emailSendingServer=45.74.138.48 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-06-27T18:41:53.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "45.74.138.48"
}