WitFoo-Artifact ::: fileHashType=sha256 ::: program=Microsoft OneDrive ::: clientIP=65.12.157.126 ::: message={"_id":"39be095e33881cca4b179405","access_method":"Client","acked":"false","action":"alert","activity":"Download","alert":"yes","alert_name":"DLP PCI Alert","alert_type":"DLP","app":"Microsoft OneDrive","app_session_id":3483912176895852176,"appcategory":"Cloud Storage","appsuite":"Microsoft Live","browser":"Native","browser_session_id":4752751631097491507,"category":"Cloud Storage","ccl":"high","connection_id":2762431970988418783,"device":"Windows Device","device_classification":"unmanaged","dlp_incident_id":138263770855113308,"dlp_is_unique_count":"false","dlp_parent_id":138263770855113308,"dlp_profile":"Payment Card Industry Data Security Standard. PCI-DSS","dlp_rule":"INTL-PAN-Name","dlp_rule_count":14375,"dlp_rule_severity":"Critical","dst_country":"US","dst_location":"Redmond","dst_region":"Washington","dst_timezone":"America/Los_Angeles","dst_zipcode":"N/A","dstip":"65.234.139.242","file_lang":"ENGLISH","file_size":10256549,"file_type":"text/plain","hostname":"Jenga-Surface","incident_id":1592565057731753570,"managed_app":"yes","md5":"2f6df9969215d9eb4d266dd636337da7","object_type":"File","organization_unit":"","os":"Windows 11","os_version":"Windows 11","outer_doc_type":0,"page":"ahokbw.sn.files.1drv.com","page_site":"Microsoft OneDrive","policy":"DLP PCI Alert","policy_id":"917683231580654373C0849096058D6E 2023-11-22 11:22:06.688367","protocol":"HTTPS/1.1","request_id":2735518334081635584,"scan_type":"","severity":"unknown","sha256":"26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f","site":"Microsoft OneDrive","src_country":"US","src_location":"San Diego","src_region":"California","src_time":"Wed Dec 20 14:33:37 2023","src_timezone":"America/Los_Angeles","src_zipcode":"92110","srcip":"65.12.157.126","timestamp":1703111643,"traffic_type":"CloudApp","transaction_id":1592565057731753570,"true_obj_category":"Text","true_obj_type":"Plain Text file","true_type_id":2,"tss_mode":"inline","type":"nspolicy","ur_normalized":"charlie","url":"ahokbw.sn.files.1drv.com/y4pBjWOfrko0wozG7PtpqexAbIQbk6HvfqD-rTeEoQiySV0aTnACx-8vtQ71n9JjmjqyAk-UFClmFcz7OmsMX0VCcQ0PGK1uE_9ijL43LJddzJSVFwnDNVmCTCp0eQOotDVVKO2PPI2Inrvfhr_gaMtlmEgg5BKS3xBUEZW7RIHqndfjcAXqqmZVchyNG2HDheNBLxQXojvR4EokTRx5rfuCl_PRTmaIfLWd5vcgXg_Msk","user":"charlie","userip":"192.168.1.194","userkey":"charlie","dynamic_classification":"","message_size":0,"universal_connector":"","displayName":"","mime_type":"","violating_user":"","user_id":"","file_cls_encrypted":false,"sAMAccountName":"","channel":"","orignal_file_path":"","data_type":"","classification_name":"","userPrincipalName":"","from_storage":"","owner_pdl":"","group":"","total_collaborator_count":0,"message_id":"","dlp_file":"credit_cards.13.db","instance_id":"","browser_version":"","exposure":"","act_user":"","dlp_unique_count":0,"smtp_to":[],"suppression_key":"credit_cards.13.db","external_collaborator_count":0,"file_category":"","collaborated":"","manager":"","mail":"","sub_type":"","app_activity":"","managementID":"","file_path":"","to_storage":"","dlp_mail_parent_id":"","dlp_fingerprint_match":"","retro_scan_name":"","src_geoip_src":0,"userCountry":"","file_password_protected":"","web_universal_connector":"","dlp_fingerprint_score":0,"sanctioned_instance":"","referer":"","parent_id":"","title":"credit_cards.13.db","to_user":"","shared_with":"","dst_geoip_src":0,"object_id":"","from_user":"","shared_domains":"","instance":"","modified":0,"true_filetype":"","dlp_rule_score":0,"dlp_fingerprint_classification":"","violating_user_type":"","local_sha256":"","object":"credit_cards.13.db","owner":"","bcc":""} ::: fileHash=26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f ::: clientHostname=Jenga-Surface ::: userName=charlie ::: streamName=netskope ::: messageType=data_exfiltration ::: serverIP=65.234.139.242 ::: startTimeUTC=2023-12-20T22:34:03Z ::: tags=[DLP PCI Alert,Microsoft OneDrive,Cloud Storage,Windows Device(unmanaged),Payment Card Industry Data Security Standard. PCI-DSS,INTL-PAN-Name]
This is a syslog message from a product called Netskope by Netskope. The following fields were extracted from the message:
clienthostname: Jenga-Surface
filehash: 26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f
messagetype: data_exfiltration
program: Microsoft OneDrive
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
starttimeutc: 2023-12-20T22:34:03Z
tags: ['data_exfiltration', 'netskope', 'INTL-PAN-Name', 'Payment Card Industry Data Security Standard. PCI-DSS', 'Windows Device(unmanaged)', 'DLP PCI Alert', 'Cloud Storage', 'Microsoft OneDrive']
streamName: netskope
clientIP: 65.12.157.126
serverIP: 65.234.139.242
userName: charlie