WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"5d209ef6aac12326a58ae2fcb439a8f4868f5f365e69fbb6a933d1591855f696","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5d209ef6aac12326a58ae2fcb439a8f4868f5f365e69fbb6a933d1591855f696","threatTime":"2023-10-13T14:25:53.000Z","threat":"r20.rs6.net/tn.jsp?f=001GELWbar1rmsUpbbFhnSrHjqkwEDn-YJ_2j4rkZNtq-A8566czbtoS8b1egd3uiP4IbYsHXAK10w2h4oVKADoPTTAH64ls6pt-8rwdwWIWaitAf6Txp-Jki5oKxDVgWdWpakeQVUuviY=","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-20T17:44:01.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"Calprivate Financial Statements 20.10.23.pdf","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","allow_relay"],"modulesRun":["av","dkimv","spf","spam","dmarc","urldefense"],"messageSize":12832,"headerFrom":"\"Financial Statements 20.10.23.pdf\" <donnap@hearttoheartadopt.com>","headerReplyTo":null,"fromAddress":["donnap@hearttoheartadopt.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["marketing@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"3cb72098af79d403dd8b62a15cbd4120867b3ded47dbe97a724720d184d7fd37","md5":"28178e63530af07bb127ad11bdfb386b","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"c6bf1d4b-17da-78df-b44f-6e43299a79bd","QID":"3tubxt0c1k-1","GUID":"G065eNoqiWGAqXuwtU-8esiLN3c8Hq9r","sender":"donnap@hearttoheartadopt.com","recipient":["marketing@acme.bank"],"senderIP":"234.148.108.45","messageID":"<5116dbad-7e05-5610-edf1-ef52a86f3643@hearttoheartadopt.com>"} ::: fileHash=<5116dbad-7e05-5610-edf1-ef52a86f3643@hearttoheartadopt.com> ::: fileName=from: donnap@hearttoheartadopt.com subj: Calprivate Financial Statements 20.10.23.pdf ::: serverIP=234.148.108.45 ::: emailFrom=donnap@hearttoheartadopt.com ::: created_at=2023-10-20T17:44:01.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Calprivate Financial Statements 20.10.23.pdf ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-20T17:44:01.000Z ::: emailSendingServer=234.148.108.45 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: donnap@hearttoheartadopt.com
emailsendingserver: 40.107.244.43
emailsubject: Calprivate Financial Statements 20.10.23.pdf
filehash: <5116dbad-7e05-5610-edf1-ef52a86f3643@hearttoheartadopt.com>
filename: from: donnap@hearttoheartadopt.com subj: Calprivate Financial Statements 20.10.23.pdf
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-20T17:44:01.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 234.148.108.45