WitFoo-Artifact ::: startTimeUTC=2023-12-20T22:35:30Z ::: fileHash=26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f ::: message={"_id":"81249af59fac3ab7c844a835","access_method":"Client","acked":"false","action":"alert","activity":"Upload","alert":"yes","alert_name":"DLP PCI Alert","alert_type":"DLP","app":"Google Drive","app_session_id":6246154062795137814,"appcategory":"Cloud Storage","appsuite":"Google App","browser":"Chrome","browser_session_id":1158867195192111991,"category":"Cloud Storage","ccl":"high","connection_id":6931294978229608808,"device":"Windows Device","device_classification":"unmanaged","dlp_incident_id":7209449232728123896,"dlp_is_unique_count":"false","dlp_parent_id":7209449232728123896,"dlp_profile":"DLP-PCI","dlp_rule":"Name-Credit Card (CC)","dlp_rule_count":179687,"dlp_rule_severity":"Critical","dst_country":"US","dst_location":"Mountain View","dst_region":"California","dst_timezone":"America/Los_Angeles","dst_zipcode":"N/A","dstip":"180.32.177.174","file_lang":"ENGLISH","file_size":10256549,"file_type":"text/plain","hostname":"Jenga-Surface","incident_id":4568525528276105698,"managed_app":"yes","md5":"2f6df9969215d9eb4d266dd636337da7","object_type":"File","organization_unit":"","os":"Windows 11","os_version":"Windows 11","outer_doc_type":0,"page":"drive.google.com","page_site":"Google Drive","policy":"DLP PCI Alert","policy_id":"917683231580654373C0849096058D6E 2023-11-22 11:22:06.688367","protocol":"HTTPS/1.1","request_id":2735519795310037760,"scan_type":"","severity":"unknown","sha256":"26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f","site":"Google Drive","src_country":"US","src_location":"San Diego","src_region":"California","src_time":"Wed Dec 20 14:35:08 2023","src_timezone":"America/Los_Angeles","src_zipcode":"92110","srcip":"146.167.21.40","timestamp":1703111730,"traffic_type":"CloudApp","transaction_id":4568525528276105698,"true_obj_category":"Text","true_obj_type":"Plain Text file","true_type_id":2,"tss_mode":"inline","type":"nspolicy","ur_normalized":"fish","url":"clients6.google.com/upload/drive/v2internal/files","user":"fish","userip":"192.168.1.194","userkey":"fish","dynamic_classification":"","message_size":0,"universal_connector":"","displayName":"","mime_type":"","violating_user":"","user_id":"","file_cls_encrypted":false,"sAMAccountName":"","channel":"","orignal_file_path":"","data_type":"","classification_name":"","userPrincipalName":"","from_storage":"","owner_pdl":"","group":"","total_collaborator_count":0,"message_id":"","dlp_file":"credit_cards.16.db","instance_id":"netskope.com","browser_version":"120.0.0.0","exposure":"","act_user":"","dlp_unique_count":0,"smtp_to":[],"suppression_key":"ABPtcPq2N8SssE1ySzASjIRG-Eg2Rnz6FMTYlT1Q7ZDVh1TAF1GaPRe1yfiKoDNs0arhRHQkbdIEbt317p_EOu0FSFgz7oxmjLjr","external_collaborator_count":0,"file_category":"","collaborated":"","manager":"","mail":"","sub_type":"","app_activity":"","managementID":"","file_path":"","to_storage":"","dlp_mail_parent_id":"","dlp_fingerprint_match":"","retro_scan_name":"","src_geoip_src":0,"userCountry":"","file_password_protected":"","web_universal_connector":"","dlp_fingerprint_score":0,"sanctioned_instance":"","referer":"https://drive.google.com/","parent_id":"","title":"credit_cards.16.db","to_user":"","shared_with":"","dst_geoip_src":0,"object_id":"ABPtcPq2N8SssE1ySzASjIRG-Eg2Rnz6FMTYlT1Q7ZDVh1TAF1GaPRe1yfiKoDNs0arhRHQkbdIEbt317p_EOu0FSFgz7oxmjLjr","from_user":"fish","shared_domains":"","instance":"","modified":0,"true_filetype":"","dlp_rule_score":0,"dlp_fingerprint_classification":"","violating_user_type":"","local_sha256":"","object":"credit_cards.16.db","owner":"","bcc":""} ::: streamName=netskope ::: fileHashType=sha256 ::: messageType=data_exfiltration ::: program=Google Drive ::: userName=fish ::: serverIP=180.32.177.174 ::: clientIP=146.167.21.40 ::: tags=[DLP PCI Alert,Google Drive,Cloud Storage,Windows Device(unmanaged),DLP-PCI,Name-Credit Card (CC)] ::: clientHostname=Jenga-Surface
This is a syslog message from a product called Netskope by Netskope. The following fields were extracted from the message:
clienthostname: Jenga-Surface
filehash: 26a8440588af2c3c061722ac27669504944c74eb89cb68ecd074ed5a56b07c7f
messagetype: data_exfiltration
program: Google Drive
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
starttimeutc: 2023-12-20T22:35:30Z
tags: ['data_exfiltration', 'Cloud Storage', 'Name-Credit Card (CC)', 'Google Drive', 'netskope', 'Windows Device(unmanaged)', 'DLP PCI Alert', 'DLP-PCI']
streamName: netskope
clientIP: 146.167.21.40
serverIP: 180.32.177.174
userName: fish