WitFoo-Artifact ::: tags=["title=TOR VPN","description=","detail=undefined"] ::: action=blocked ::: message={"id":"11f032ebc484ed4091c7119f42d63a05","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1701983456161,"severity":"HIGH","title":"TOR VPN","description":"","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"437bbda263aa64099305d85d58f93445","cloud_service":"Office 365","timestamp":1701983245000,"user_id":"user_9b14ef228a9868ae38a88daf9a3fbb9a","user_email":"johndoe","full_name":"Elvia Soukup","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) PKeyAuth/1.0","location":"United States of America, California, Los Angeles","geo_location":[-118.24390411376953,34.05257034301758],"intelligence":[{"ip_address":"9.171.28.225"}],"event_classification":{"id":"9814","category":"Successful Login","sub_category":"Login to O365","threat":"Authentication"},"meta_data":{"extracted_fields":[{"128763":"[\"user\"]"},{"128764":"[\"johndoe\"]"}]}}]} ::: program=Office 365 ::: clientIP=9.171.28.225 ::: userName=johndoe ::: geoRegion=United States of America, California, Los Angeles ::: created_at=1701983456161 ::: streamName=proofpoint_casb ::: vendorCode=9814 ::: messageType=malicious_session ::: pipelineName=proofpoint_casb ::: severityCode=2 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "georegion": "United States of America, California, Los Angeles",
    "message": "WitFoo-Artifact ::: tags=[\"title=TOR VPN\",\"description=\",\"detail=undefined\"] ::: action=blocked ::: message={\"id\":\"11f032ebc484ed4091c7119f42d63a05\",\"tenant_id\":\"tenant_a41e6a657eef469dbfe7b26dbeeb4827\",\"timestamp\":1701983456161,\"severity\":\"HIGH\",\"title\":\"TOR VPN\",\"description\":\"\",\"type\":\"Footprint\",\"sub_type\":\"Suspicious Login\",\"related_events\":[{\"event_id\":\"437bbda263aa64099305d85d58f93445\",\"cloud_service\":\"Office 365\",\"timestamp\":1701983245000,\"user_id\":\"user_9b14ef228a9868ae38a88daf9a3fbb9a\",\"user_email\":\"johndoe\",\"full_name\":\"Elvia Soukup\",\"user_agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) PKeyAuth/1.0\",\"location\":\"United States of America, California, Los Angeles\",\"geo_location\":[-118.24390411376953,34.05257034301758],\"intelligence\":[{\"ip_address\":\"9.171.28.225\"}],\"event_classification\":{\"id\":\"9814\",\"category\":\"Successful Login\",\"sub_category\":\"Login to O365\",\"threat\":\"Authentication\"},\"meta_data\":{\"extracted_fields\":[{\"128763\":\"[\\\"user\\\"]\"},{\"128764\":\"[\\\"johndoe\\\"]\"}]}}]} ::: program=Office 365 ::: clientIP=9.171.28.225 ::: userName=johndoe ::: geoRegion=United States of America, California, Los Angeles ::: created_at=1701983456161 ::: streamName=proofpoint_casb ::: vendorCode=9814 ::: messageType=malicious_session ::: pipelineName=proofpoint_casb ::: severityCode=2 ::: pipelineEntrypoint=dispatch",
    "messagetype": "malicious_session",
    "program": "Office 365",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "tags": [
        "proofpoint_casb",
        "title=TOR VPN",
        "description=",
        "detail=undefined",
        "malicious_session"
    ],
    "vendorcode": "9814",
    "streamName": "proofpoint_casb",
    "clientIP": "9.171.28.225",
    "userName": "johndoe"
}