WitFoo-Artifact ::: tags=["title=CPB - Failed Suspicious Login","description=Failed Suspicious Login Has Been Detected","detail=undefined"] ::: action=blocked ::: message={"id":"4c0dac0356d5d0022b179ae8b5d301ae","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1703767556538,"severity":"LOW","title":"CPB - Failed Suspicious Login","description":"Failed Suspicious Login Has Been Detected","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"6732cb3d5214e5f797b587ba5575d712","cloud_service":"Office 365","timestamp":1703767039000,"user_id":"user_11c2cc7851a92e8fa0cbfc35d063c74d","user_email":"charlie","full_name":"Richard Smith","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36","location":"Czechia, Zlinsky kraj, Borsice","geo_location":[17.350839614868164,49.062538146972656],"intelligence":[{"ip_address":"98.6.245.122"}],"event_classification":{"id":"9852","category":"Suspicious Login","sub_category":"Suspicious Login","threat":"Authentication"},"meta_data":{"extracted_fields":[{"129064":"[\"50\"]"},{"129065":"[\"Failure\"]"},{"129067":"[\"Suspicious login attempt detected for charlie, from Bruteforcer 98.6.245.122 (UnArtel s.r.o.) \\n\\nThreat intelligence: \\nProofpoint CASB | IP Last Seen On: 2023-12-28\\nProofpoint CASB | Categories: Bruteforcer\\nIP Enrichments | Usage Type: ISP (Fixed Line ISP)\\nIP Enrichments | Domain: unartel.cz\\n\\nBehavioral indicators for charlie: \\nRare country score: High (common country: United States)\\nRare user agent score: High (common user agent: ios/16.6//mobile safari////iphone/apple)\\nRare isp score: High (common isp: T-Mobile USA Inc.)\"]"},{"129068":"[\"Low\"]"}]}}]} ::: program=Office 365 ::: clientIP=98.6.245.122 ::: userName=charlie ::: geoRegion=Czechia, Zlinsky kraj, Borsice ::: created_at=1703767556538 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch
Product: CASB
Vendor: ProofPoint