WitFoo-Artifact ::: tags=["title=TOR VPN","description=","detail=undefined"] ::: action=blocked ::: message={"id":"11f032ebc484ed4091c7119f42d63a05","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1701983456161,"severity":"HIGH","title":"TOR VPN","description":"","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"437bbda263aa64099305d85d58f93445","cloud_service":"Office 365","timestamp":1701983245000,"user_id":"user_9b14ef228a9868ae38a88daf9a3fbb9a","user_email":"fish","full_name":"Elvia Soukup","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) PKeyAuth/1.0","location":"United States of America, California, Los Angeles","geo_location":[-118.24390411376953,34.05257034301758],"intelligence":[{"ip_address":"85.105.156.130"}],"event_classification":{"id":"9814","category":"Successful Login","sub_category":"Login to O365","threat":"Authentication"},"meta_data":{"extracted_fields":[{"128763":"[\"user\"]"},{"128764":"[\"fish\"]"}]}}]} ::: program=Office 365 ::: clientIP=85.105.156.130 ::: userName=fish ::: geoRegion=United States of America, California, Los Angeles ::: created_at=1701983456161 ::: streamName=proofpoint_casb ::: vendorCode=9814 ::: messageType=malicious_session ::: pipelineName=proofpoint_casb ::: severityCode=2 ::: pipelineEntrypoint=dispatch
Product: CASB
Vendor: ProofPoint