WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"ebcc380463853a3c83a43399c0675c3f649fa7d0238d36fd4598cdb703e567a0","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ebcc380463853a3c83a43399c0675c3f649fa7d0238d36fd4598cdb703e567a0","threatTime":"2023-03-21T10:16:23.000Z","threat":"ebcc380463853a3c83a43399c0675c3f649fa7d0238d36fd4598cdb703e567a0","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-03-21T10:17:25.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Voicemail Transcription Message on March 21, 2023, 6:15:57 PM ","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound","umbrella_from"],"modulesRun":["access","av","zerohour","spf","sandbox","spam","dmarc","urldefense"],"messageSize":2250066,"headerFrom":"\"Calprivate-ISF Caller\" <security@umbrella.bank>","headerReplyTo":null,"fromAddress":["security@umbrella.bank"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["security@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"attumbrellaed","sha256":"ebcc380463853a3c83a43399c0675c3f649fa7d0238d36fd4598cdb703e567a0","md5":"087abe3ee83a6f58f832b7b33d510560","filename":"☎**?0113202023.htm.","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"4b21ab0e-56a7-b4f5-e4c4-053b18b99c05","QID":"3pex22g7k9-1","GUID":"ZWYhopSc7nUjt2wVLEyfdZXzAt3JHpO8","sender":"security@umbrella.bank","recipient":["security@umbrella.bank"],"senderIP":"213.133.182.206","messageID":"<15f00a8b-65c4-ce0a-c3eb-e875ef99b6f2@umbrella.bank>"} ::: fileHash=<15f00a8b-65c4-ce0a-c3eb-e875ef99b6f2@umbrella.bank> ::: fileName=from: security@umbrella.bank subj: Voicemail Transcription Message on March 21, 2023, 6:15:57 PM  ::: serverIP=213.133.182.206 ::: emailFrom=security@umbrella.bank ::: created_at=2023-03-21T10:17:25.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Voicemail Transcription Message on March 21, 2023, 6:15:57 PM  ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-03-21T10:17:25.000Z ::: emailSendingServer=213.133.182.206 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
emailsubject: Voicemail Transcription Message on March 21, 2023, 6:15:57 PM
senderhost: localhost
severitylabel: critical
starttimeutc: 2023-03-21T10:17:25.000Z
tags: ['proofpoint_protect', 'email_protection_event']
productids: [32, 0]
filename: from: security@calprivate.bank subj: Voicemail Transcription Message on March 21, 2023, 6:15:57 PM
severitycode: 2
sensitivity: normal
emailsendingserver: 103.28.236.44
messagetype: email_protection_event
emailfrom: security@calprivate.bank
sourceinfo: unknown
filehash: <15f00a8b-65c4-ce0a-c3eb-e875ef99b6f2@calprivate.bank>
vendorcode: blocked_message
action: block
streamName: proofpoint_protect
serverIP: 213.133.182.206