WitFoo-Artifact ::: fqdn=cab8fsphak15dd000010y57568uuxhcx6.oast.live ::: action=BLOCKED ::: message={"originId":410614338,"originType":"AD Users","internalIp":"84.244.181.221","externalIp":"190.29.0.69","categories":["Malware","Infrastructure and Content Delivery Networks"],"tags":[],"destination":"cab8fsphak15dd000010y57568uuxhcx6.oast.live","originLabel":"fish","actionTaken":"BLOCKED","datetime":"2022-05-31T21:31:53.000Z"} ::: clientIP=84.244.181.221 ::: serverIP=190.29.0.69 ::: userName=fish ::: created_at=2022-05-31T21:31:53.000Z ::: streamName=OpenDNS Detection ::: vendorCode=MalwareInfrastructure and Content Delivery Networks ::: messageType=firewall_action ::: pipelineName=OpenDNS Detection ::: severityCode=2 ::: startTimeUTC=2022-05-31T21:31:53.000Z ::: serverHostname=cab8fsphak15dd000010y57568uuxhcx6.oast.live ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Umbrella by Cisco. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 2022-05-31T21:31:53.000Z
tags: ['OpenDNS Detection', 'firewall_action']
productids: [38, 0]
sourceinfo: unknown
sensitivity: normal
serverhostname: cab8fsphak15dd000010y57568uuxhcx6.oast.live
messagetype: firewall_action
severitycode: 2
fqdn: cab8fsphak15dd000010y57568uuxhcx6.oast.live
vendorcode: MalwareInfrastructure and Content Delivery Networks
action: block
streamName: OpenDNS Detection
clientIP: 84.244.181.221
serverIP: 190.29.0.69
userName: fish