WitFoo-Artifact ::: startTimeUTC=2023-12-20T22:34:18Z ::: fileHash=26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f ::: fileHashType=sha256 ::: messageType=data_exfiltration ::: userName=charlie ::: tags=[DLP PCI Alert,Microsoft OneDrive,Cloud Storage,Windows Device(unmanaged),Payment Card Industry Data Security Standard. PCI-DSS,INTL-PAN-Name] ::: program=Microsoft OneDrive ::: serverIP=242.230.102.12 ::: message={"_id":"07f04ab91fcc5938cc761e29","access_method":"Client","acked":"false","action":"alert","activity":"Download","alert":"yes","alert_name":"DLP PCI Alert","alert_type":"DLP","app":"Microsoft OneDrive","app_session_id":3483912176895852176,"appcategory":"Cloud Storage","appsuite":"Microsoft Live","browser":"Native","browser_session_id":4752751631097491507,"category":"Cloud Storage","ccl":"high","connection_id":2762431970988418783,"device":"Windows Device","device_classification":"unmanaged","dlp_incident_id":5280306427193846442,"dlp_is_unique_count":"false","dlp_parent_id":5280306427193846442,"dlp_profile":"Payment Card Industry Data Security Standard. PCI-DSS","dlp_rule":"INTL-PAN-Name","dlp_rule_count":14375,"dlp_rule_severity":"Critical","dst_country":"US","dst_location":"Redmond","dst_region":"Washington","dst_timezone":"America/Los_Angeles","dst_zipcode":"N/A","dstip":"242.230.102.12","file_lang":"ENGLISH","file_size":10256549,"file_type":"text/plain","hostname":"Jenga-Surface","incident_id":3499902958723489393,"managed_app":"yes","md5":"2f6df9969215d9eb4d266dd636337da7","object_type":"File","organization_unit":"","os":"Windows 11","os_version":"Windows 11","outer_doc_type":0,"page":"ahokbw.sn.files.1drv.com","page_site":"Microsoft OneDrive","policy":"DLP PCI Alert","policy_id":"917683231580654373C0849096058D6E 2023-11-22 11:22:06.688367","protocol":"HTTPS/1.1","request_id":2735518334081635584,"scan_type":"","severity":"unknown","sha256":"26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f","site":"Microsoft OneDrive","src_country":"US","src_location":"San Diego","src_region":"California","src_time":"Wed Dec 20 14:34:08 2023","src_timezone":"America/Los_Angeles","src_zipcode":"92110","srcip":"32.184.221.39","timestamp":1703111658,"traffic_type":"CloudApp","transaction_id":3499902958723489393,"true_obj_category":"Text","true_obj_type":"Plain Text file","true_type_id":2,"tss_mode":"inline","type":"nspolicy","ur_normalized":"charlie","url":"ahokbw.sn.files.1drv.com/y4psL62HbEFnEiVCJju7Wkx8xiTopeE69Q-fp_jwVkidP1I2aT4LBfzC7T3WMR3YlQzS--L3xnLAZlcnuBpjdJpaAdQhCHcBXmAXQFH-vYhATrAfYIbCCHNNHdz0N0PeQvzDoXjAbrXEtpDmaJQMF0t7X0zQ-ujS6eCw1A2NEV9FrQxPilF2YnXOqpT5pLhFp-RsiV_Mc8-o2XzYuVXC3vbcfdfZLqBaSwDfakRJ8w4uG8","user":"charlie","userip":"192.168.1.194","userkey":"charlie","dynamic_classification":"","message_size":0,"universal_connector":"","displayName":"","mime_type":"","violating_user":"","user_id":"","file_cls_encrypted":false,"sAMAccountName":"","channel":"","orignal_file_path":"","data_type":"","classification_name":"","userPrincipalName":"","from_storage":"","owner_pdl":"","group":"","total_collaborator_count":0,"message_id":"","dlp_file":"credit_cards.14.db","instance_id":"","browser_version":"","exposure":"","act_user":"","dlp_unique_count":0,"smtp_to":[],"suppression_key":"credit_cards.14.db","external_collaborator_count":0,"file_category":"","collaborated":"","manager":"","mail":"","sub_type":"","app_activity":"","managementID":"","file_path":"","to_storage":"","dlp_mail_parent_id":"","dlp_fingerprint_match":"","retro_scan_name":"","src_geoip_src":0,"userCountry":"","file_password_protected":"","web_universal_connector":"","dlp_fingerprint_score":0,"sanctioned_instance":"","referer":"","parent_id":"","title":"credit_cards.14.db","to_user":"","shared_with":"","dst_geoip_src":0,"object_id":"","from_user":"","shared_domains":"","instance":"","modified":0,"true_filetype":"","dlp_rule_score":0,"dlp_fingerprint_classification":"","violating_user_type":"","local_sha256":"","object":"credit_cards.14.db","owner":"","bcc":""} ::: streamName=netskope ::: clientIP=32.184.221.39 ::: clientHostname=Jenga-Surface
{
    "clienthostname": "Jenga-Surface",
    "filehash": "26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f",
    "message": "WitFoo-Artifact ::: startTimeUTC=2023-12-20T22:34:18Z ::: fileHash=26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f ::: fileHashType=sha256 ::: messageType=data_exfiltration ::: userName=charlie ::: tags=[DLP PCI Alert,Microsoft OneDrive,Cloud Storage,Windows Device(unmanaged),Payment Card Industry Data Security Standard. PCI-DSS,INTL-PAN-Name] ::: program=Microsoft OneDrive ::: serverIP=242.230.102.12 ::: message={\"_id\":\"07f04ab91fcc5938cc761e29\",\"access_method\":\"Client\",\"acked\":\"false\",\"action\":\"alert\",\"activity\":\"Download\",\"alert\":\"yes\",\"alert_name\":\"DLP PCI Alert\",\"alert_type\":\"DLP\",\"app\":\"Microsoft OneDrive\",\"app_session_id\":3483912176895852176,\"appcategory\":\"Cloud Storage\",\"appsuite\":\"Microsoft Live\",\"browser\":\"Native\",\"browser_session_id\":4752751631097491507,\"category\":\"Cloud Storage\",\"ccl\":\"high\",\"connection_id\":2762431970988418783,\"device\":\"Windows Device\",\"device_classification\":\"unmanaged\",\"dlp_incident_id\":5280306427193846442,\"dlp_is_unique_count\":\"false\",\"dlp_parent_id\":5280306427193846442,\"dlp_profile\":\"Payment Card Industry Data Security Standard. PCI-DSS\",\"dlp_rule\":\"INTL-PAN-Name\",\"dlp_rule_count\":14375,\"dlp_rule_severity\":\"Critical\",\"dst_country\":\"US\",\"dst_location\":\"Redmond\",\"dst_region\":\"Washington\",\"dst_timezone\":\"America/Los_Angeles\",\"dst_zipcode\":\"N/A\",\"dstip\":\"242.230.102.12\",\"file_lang\":\"ENGLISH\",\"file_size\":10256549,\"file_type\":\"text/plain\",\"hostname\":\"Jenga-Surface\",\"incident_id\":3499902958723489393,\"managed_app\":\"yes\",\"md5\":\"2f6df9969215d9eb4d266dd636337da7\",\"object_type\":\"File\",\"organization_unit\":\"\",\"os\":\"Windows 11\",\"os_version\":\"Windows 11\",\"outer_doc_type\":0,\"page\":\"ahokbw.sn.files.1drv.com\",\"page_site\":\"Microsoft OneDrive\",\"policy\":\"DLP PCI Alert\",\"policy_id\":\"917683231580654373C0849096058D6E 2023-11-22 11:22:06.688367\",\"protocol\":\"HTTPS/1.1\",\"request_id\":2735518334081635584,\"scan_type\":\"\",\"severity\":\"unknown\",\"sha256\":\"26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f\",\"site\":\"Microsoft OneDrive\",\"src_country\":\"US\",\"src_location\":\"San Diego\",\"src_region\":\"California\",\"src_time\":\"Wed Dec 20 14:34:08 2023\",\"src_timezone\":\"America/Los_Angeles\",\"src_zipcode\":\"92110\",\"srcip\":\"32.184.221.39\",\"timestamp\":1703111658,\"traffic_type\":\"CloudApp\",\"transaction_id\":3499902958723489393,\"true_obj_category\":\"Text\",\"true_obj_type\":\"Plain Text file\",\"true_type_id\":2,\"tss_mode\":\"inline\",\"type\":\"nspolicy\",\"ur_normalized\":\"charlie\",\"url\":\"ahokbw.sn.files.1drv.com/y4psL62HbEFnEiVCJju7Wkx8xiTopeE69Q-fp_jwVkidP1I2aT4LBfzC7T3WMR3YlQzS--L3xnLAZlcnuBpjdJpaAdQhCHcBXmAXQFH-vYhATrAfYIbCCHNNHdz0N0PeQvzDoXjAbrXEtpDmaJQMF0t7X0zQ-ujS6eCw1A2NEV9FrQxPilF2YnXOqpT5pLhFp-RsiV_Mc8-o2XzYuVXC3vbcfdfZLqBaSwDfakRJ8w4uG8\",\"user\":\"charlie\",\"userip\":\"192.168.1.194\",\"userkey\":\"charlie\",\"dynamic_classification\":\"\",\"message_size\":0,\"universal_connector\":\"\",\"displayName\":\"\",\"mime_type\":\"\",\"violating_user\":\"\",\"user_id\":\"\",\"file_cls_encrypted\":false,\"sAMAccountName\":\"\",\"channel\":\"\",\"orignal_file_path\":\"\",\"data_type\":\"\",\"classification_name\":\"\",\"userPrincipalName\":\"\",\"from_storage\":\"\",\"owner_pdl\":\"\",\"group\":\"\",\"total_collaborator_count\":0,\"message_id\":\"\",\"dlp_file\":\"credit_cards.14.db\",\"instance_id\":\"\",\"browser_version\":\"\",\"exposure\":\"\",\"act_user\":\"\",\"dlp_unique_count\":0,\"smtp_to\":[],\"suppression_key\":\"credit_cards.14.db\",\"external_collaborator_count\":0,\"file_category\":\"\",\"collaborated\":\"\",\"manager\":\"\",\"mail\":\"\",\"sub_type\":\"\",\"app_activity\":\"\",\"managementID\":\"\",\"file_path\":\"\",\"to_storage\":\"\",\"dlp_mail_parent_id\":\"\",\"dlp_fingerprint_match\":\"\",\"retro_scan_name\":\"\",\"src_geoip_src\":0,\"userCountry\":\"\",\"file_password_protected\":\"\",\"web_universal_connector\":\"\",\"dlp_fingerprint_score\":0,\"sanctioned_instance\":\"\",\"referer\":\"\",\"parent_id\":\"\",\"title\":\"credit_cards.14.db\",\"to_user\":\"\",\"shared_with\":\"\",\"dst_geoip_src\":0,\"object_id\":\"\",\"from_user\":\"\",\"shared_domains\":\"\",\"instance\":\"\",\"modified\":0,\"true_filetype\":\"\",\"dlp_rule_score\":0,\"dlp_fingerprint_classification\":\"\",\"violating_user_type\":\"\",\"local_sha256\":\"\",\"object\":\"credit_cards.14.db\",\"owner\":\"\",\"bcc\":\"\"} ::: streamName=netskope ::: clientIP=32.184.221.39 ::: clientHostname=Jenga-Surface",
    "messagetype": "data_exfiltration",
    "program": "Microsoft OneDrive",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-12-20T22:34:18Z",
    "tags": [
        "data_exfiltration",
        "netskope",
        "INTL-PAN-Name",
        "Payment Card Industry Data Security Standard. PCI-DSS",
        "Windows Device(unmanaged)",
        "DLP PCI Alert",
        "Cloud Storage",
        "Microsoft OneDrive"
    ],
    "streamName": "netskope",
    "clientIP": "32.184.221.39",
    "serverIP": "242.230.102.12",
    "userName": "charlie"
}