WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657","threatTime":"2023-07-25T00:54:07.000Z","threat":"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//fexrik/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=","campaignID":null,"threatType":"url"},{"threatID":"851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403","threatTime":"2023-07-25T00:53:59.000Z","threat":"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//lpzhpy/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=","campaignID":null,"threatType":"url"}],"messageTime":"2023-07-25T00:53:05.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Reminder: Action needed for Sandiegoprivatebank","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","allow_relay"],"modulesRun":["av","dkimv","spf","spam","dmarc","urldefense"],"messageSize":19226,"headerFrom":"\"Server Authenticator\" <aldo@morbexautomation.com>","headerReplyTo":null,"fromAddress":["aldo@morbexautomation.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"c68ca51360e7a31951ba6071bf49664928e522f9c8c6a4ddb0a08c0758672006","md5":"5115562031761b7c91ecd463fc9cab34","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"55990dc6930995d80d3be41c834c29af8f1d1c2843371af2cce2c7a7fd62cc1f","md5":"ce19f785bb6cc85d1687d85ef94490a5","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"c7e8da4f-606d-b89c-364d-8028785042f9","QID":"3s0ayq8tr9-1","GUID":"pI4IY3PnYHlFmqYHXghwZgfZVgmkdPaS","sender":"aldo@morbexautomation.com","recipient":["twornham@sandiegoprivatebank.net"],"senderIP":"152.81.39.114","messageID":"<20232407175259D4B2639621-0F119D63A7@morbexautomation.com>"} ::: fileHash=<20232407175259D4B2639621-0F119D63A7@morbexautomation.com> ::: fileName=from: aldo@morbexautomation.com subj: Reminder: Action needed for Sandiegoprivatebank ::: serverIP=152.81.39.114 ::: emailFrom=aldo@morbexautomation.com ::: created_at=2023-07-25T00:53:05.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Reminder: Action needed for Sandiegoprivatebank ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-25T00:53:05.000Z ::: emailSendingServer=152.81.39.114 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: aldo@morbexautomation.com
emailsendingserver: 40.107.237.120
emailsubject: Reminder: Action needed for Sandiegoprivatebank
filehash: <20232407175259D4B2639621-0F119D63A7@morbexautomation.com>
filename: from: aldo@morbexautomation.com subj: Reminder: Action needed for Sandiegoprivatebank
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-07-25T00:53:05.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 152.81.39.114