WitFoo-Artifact ::: fqdn=url4547.ascnow.com ::: action=BLOCKED ::: message={"originId":410613954,"originType":"AD Users","internalIp":"217.184.196.111","externalIp":"55.226.97.234","categories":["Business Services","Phishing","Business and Industry"],"tags":[],"destination":"url4547.ascnow.com","originLabel":"charlie","actionTaken":"BLOCKED","datetime":"2022-09-20T14:03:48.000Z"} ::: clientIP=217.184.196.111 ::: serverIP=55.226.97.234 ::: userName=charlie ::: created_at=2022-09-20T14:03:48.000Z ::: streamName=OpenDNS Detection ::: vendorCode=Business ServicesPhishingBusiness and Industry ::: messageType=firewall_action ::: pipelineName=OpenDNS Detection ::: severityCode=2 ::: startTimeUTC=2022-09-20T14:03:48.000Z ::: serverHostname=url4547.ascnow.com ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Umbrella by Cisco. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 2022-09-20T14:03:48.000Z
tags: ['OpenDNS Detection', 'firewall_action']
productids: [38, 0]
sourceinfo: unknown
sensitivity: normal
serverhostname: url4547.ascnow.com
messagetype: firewall_action
severitycode: 2
fqdn: url4547.ascnow.com
vendorcode: Business ServicesPhishingBusiness and Industry
action: block
streamName: OpenDNS Detection
clientIP: 217.184.196.111
serverIP: 55.226.97.234
userName: charlie