WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"60fed920412203883b363fa2b35d03374c3893f4d6e84e6e3ad0f5f04793e8a2","threatStatus":"active","classification":"toad","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/60fed920412203883b363fa2b35d03374c3893f4d6e84e6e3ad0f5f04793e8a2","threatTime":"2023-10-05T12:34:16.000Z","threat":"rabadeswawilamsonea@gmail.com:1J4UzI3dFSpiZN15722pO8D1sa2lrPZF","campaignID":null,"threatType":"messageText"}],"messageTime":"2023-10-05T12:34:15.000Z","impostorScore":0,"malwareScore":100,"cluster":"acme_hosted","subject":"Nancy Keiper MEKMTPOAMS4655614646590 cbirkmann@acme.bank","quarantineFolder":"Malware","quarantineRule":"inbound_malware","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","pdr","urldefense"],"messageSize":54890,"headerFrom":"Nancy Keiper#OAMS8111<rabadeswawilamsonea@gmail.com>","headerReplyTo":null,"fromAddress":["rabadeswawilamsonea@gmail.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["cbirkmann@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"56b05292faf47bac6f16485bc089c67cb3a18902bf7b09c158e830517658d4d7","md5":"0065edeb558f43abe7f969bcea99f3a2","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"attacmeed","sha256":"d3d55e12831032b2d0ec73f6675afe06c8591dcb0c2d4462f18860ef6de1e5a3","md5":"11efcb96388aa4e1b42b3dadec13ffc7","filename":"4655614646590cpsj.pdf","sandboxStatus":"UNKNOWN","oContentType":"application/pdf","contentType":"application/pdf"}],"completelyRewritten":false,"id":"2f7dd3fa-c082-2615-c96b-ebd16e753f07","QID":"3tej2ca3qn-1","GUID":"1J4UzI3dFSpiZN15722pO8D1sa2lrPZF","sender":"rabadeswawilamsonea@gmail.com","recipient":["cbirkmann@acme.bank"],"senderIP":"208.189.46.221","messageID":"<651ead43.050a0220.b0893.319a@mx.google.com>"} ::: fileHash=<651ead43.050a0220.b0893.319a@mx.google.com> ::: fileName=from: rabadeswawilamsonea@gmail.com subj: Nancy Keiper MEKMTPOAMS4655614646590 cbirkmann@acme.bank ::: serverIP=208.189.46.221 ::: emailFrom=rabadeswawilamsonea@gmail.com ::: created_at=2023-10-05T12:34:15.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Nancy Keiper MEKMTPOAMS4655614646590 cbirkmann@acme.bank ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-05T12:34:15.000Z ::: emailSendingServer=208.189.46.221 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: rabadeswawilamsonea@gmail.com
emailsendingserver: 209.85.210.177
emailsubject: Nancy Keiper MEKMTPOAMS4655614646590 cbirkmann@calprivate.bank
filehash: <651ead43.050a0220.b0893.319a@mx.google.com>
filename: from: rabadeswawilamsonea@gmail.com subj: Nancy Keiper MEKMTPOAMS4655614646590 cbirkmann@calprivate.bank
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-05T12:34:15.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 208.189.46.221