WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"f567698d30fa03bdbae9427f1ff666e703321068e913ca9a83f945323cdba16a","threatStatus":"active","classification":"impostor","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f567698d30fa03bdbae9427f1ff666e703321068e913ca9a83f945323cdba16a","threatTime":"2023-10-05T21:14:02.000Z","threat":"jwhitney@ewccpas.com:B-OXKEZUzC09xJgjIOxXL8Z52UuGt1W_","campaignID":null,"threatType":"messageText"}],"messageTime":"2023-10-05T21:16:32.000Z","impostorScore":100,"malwareScore":0,"cluster":"oscorp_hosted","subject":"Fw: Enrollment Request","quarantineFolder":"Impostor","quarantineRule":"inbound_impostor","policyRoutes":["default_inbound","secure_reroute","allow_relay"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":190124,"headerFrom":"Jill Whitney <jwhitney@ewccpas.com>","headerReplyTo":null,"fromAddress":["jwhitney@ewccpas.com"],"ccAddresses":["shl@levyfinancialservicescpa.com"],"replyToAddress":[],"toAddresses":["cretana@oscorp.bank"],"xmailer":null,"messageParts":[{"disposition":"attoscorped","sha256":"c79251887ddfce31b5e4df2d836d1fe18d420431069715de6d05f76b0db9af77","md5":"a5c068c57b93788e756ff82441bd5d4e","filename":"slevy_license_front.pdf","sandboxStatus":"CLEAN","oContentType":"application/pdf","contentType":"application/pdf"},{"disposition":"attoscorped","sha256":"a86dc90c3a4e9cb7b766384928592032d0783d5714690b9497560074c40ce390","md5":"696f93c6e8bd867fd07de2d9a68b7d4d","filename":"slevy_license_back.pdf","sandboxStatus":"CLEAN","oContentType":"application/pdf","contentType":"application/pdf"},{"disposition":"inline","sha256":"cb745300f5123bd6a74110a99705dbc8ed5e6f54381d26fdf11e91268670fedb","md5":"b1e2027f1cc639f49b7ff43295418abb","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"89312f2c3df0171b51533725d41dfdf54e4c9180e796ed885294398d270947fa","md5":"56928aab39a7849f967816a82b65762d","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"8ad4ad72-9060-345f-971f-71243ff1338c","QID":"3tefhrtbqb-1","GUID":"Aj4sEDlbLITme3YDUTT85BB1BW97wR-Y","sender":"jwhitney@ewccpas.com","recipient":["cretana@oscorp.bank"],"senderIP":"234.231.97.208","messageID":"<DM6PR12MB27155C50595DDA8830C00055DFCAA@DM6PR12MB2715.namprd12.prod.outlook.com>"} ::: fileHash=<DM6PR12MB27155C50595DDA8830C00055DFCAA@DM6PR12MB2715.namprd12.prod.outlook.com> ::: fileName=from: jwhitney@ewccpas.com subj: Fw: Enrollment Request ::: serverIP=234.231.97.208 ::: emailFrom=jwhitney@ewccpas.com ::: created_at=2023-10-05T21:16:32.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Fw: Enrollment Request ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-05T21:16:32.000Z ::: emailSendingServer=234.231.97.208 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: jwhitney@ewccpas.com
emailsendingserver: 40.107.237.131
emailsubject: Fw: Enrollment Request
filehash: <DM6PR12MB27155C50595DDA8830C00055DFCAA@DM6PR12MB2715.namprd12.prod.outlook.com>
filename: from: jwhitney@ewccpas.com subj: Fw: Enrollment Request
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-05T21:16:32.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 234.231.97.208