WitFoo-Artifact ::: startTimeUTC=2024-07-05T15:05:00Z ::: streamName=azure_security_alert ::: application=ThreatManagement ::: tags=[This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3,Email reported by user as malware or phish] ::: endTimeUTC=2024-07-05T16:21:05.66Z ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-05T15:11:31.14Z","description":"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-05T15:05:00Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"7ebfc35d-e754-f463-25de-08dc9d018115","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-05T16:21:05.66Z","malwareStates":[],"messageSecurityStates":[],"networkConnections":[],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"low","sourceMaterials":["https://security.microsoft.com/viewalerts?id=7ebfc35d-e754-f463-25de-08dc9d018115"],"status":"resolved","tags":[],"title":"Email reported by user as malware or phish","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"bounces+SRS=vlg1W=OF","domainName":"fsdaf264.onmicrosoft.com","emailRole":"unknown","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"bounces+SRS=vlg1W=OF@fsdaf264.onmicrosoft.com"},{"aadUserId":null,"accountName":"diskit \u003cquickbooks","domainName":"notification.intuit.com\u003e","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"diskit \u003cquickbooks@notification.intuit.com\u003e"},{"aadUserId":null,"accountName":"member","domainName":"scriptsy.xyz","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"member@scriptsy.xyz"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: program=azure_security ::: emailTo=member@scriptsy.xyz ::: created_at=2024-07-05T15:05:00Z ::: severityCode=4 ::: emailFrom=diskit <quickbooks@notification.intuit.com> ::: messageType=malicious_session ::: severityLabel=low
{
    "application": "ThreatManagement",
    "emailfrom": "diskit <quickbooks@notification.intuit.com>",
    "emailto": "member@scriptsy.xyz",
    "endtimeutc": "2024-07-05T16:21:05.66Z",
    "message": "WitFoo-Artifact ::: startTimeUTC=2024-07-05T15:05:00Z ::: streamName=azure_security_alert ::: application=ThreatManagement ::: tags=[This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3,Email reported by user as malware or phish] ::: endTimeUTC=2024-07-05T16:21:05.66Z ::: message={\"activityGroupName\":null,\"alertDetections\":[],\"assignedTo\":null,\"azureSubscriptionId\":null,\"azureTenantId\":\"4055bd5f-b117-4bb4-befa-de484bd06de8\",\"category\":\"ThreatManagement\",\"closedDateTime\":null,\"cloudAppStates\":[],\"comments\":[\"New alert\"],\"confidence\":null,\"createdDateTime\":\"2024-07-05T15:11:31.14Z\",\"description\":\"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3\",\"detectionIds\":[],\"eventDateTime\":\"2024-07-05T15:05:00Z\",\"feedback\":null,\"fileStates\":[],\"historyStates\":[],\"hostStates\":[],\"id\":\"7ebfc35d-e754-f463-25de-08dc9d018115\",\"incidentIds\":[],\"investigationSecurityStates\":[],\"lastEventDateTime\":null,\"lastModifiedDateTime\":\"2024-07-05T16:21:05.66Z\",\"malwareStates\":[],\"messageSecurityStates\":[],\"networkConnections\":[],\"processes\":[],\"recommendedActions\":[],\"registryKeyStates\":[],\"riskScore\":null,\"securityResources\":[],\"severity\":\"low\",\"sourceMaterials\":[\"https://security.microsoft.com/viewalerts?id=7ebfc35d-e754-f463-25de-08dc9d018115\"],\"status\":\"resolved\",\"tags\":[],\"title\":\"Email reported by user as malware or phish\",\"triggers\":[],\"uriClickSecurityStates\":[],\"userStates\":[{\"aadUserId\":null,\"accountName\":\"bounces+SRS=vlg1W=OF\",\"domainName\":\"fsdaf264.onmicrosoft.com\",\"emailRole\":\"unknown\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"bounces+SRS=vlg1W=OF@fsdaf264.onmicrosoft.com\"},{\"aadUserId\":null,\"accountName\":\"diskit \\u003cquickbooks\",\"domainName\":\"notification.intuit.com\\u003e\",\"emailRole\":\"sender\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"diskit \\u003cquickbooks@notification.intuit.com\\u003e\"},{\"aadUserId\":null,\"accountName\":\"member\",\"domainName\":\"scriptsy.xyz\",\"emailRole\":\"recipient\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"member@scriptsy.xyz\"}],\"vendorInformation\":{\"provider\":\"Office 365 Security and Compliance\",\"providerVersion\":null,\"subProvider\":null,\"vendor\":\"Microsoft\"},\"vulnerabilityStates\":[]} ::: program=azure_security ::: emailTo=member@scriptsy.xyz ::: created_at=2024-07-05T15:05:00Z ::: severityCode=4 ::: emailFrom=diskit <quickbooks@notification.intuit.com> ::: messageType=malicious_session ::: severityLabel=low",
    "messagetype": "malicious_session",
    "program": "azure_security",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2024-07-05T15:05:00Z",
    "tags": [
        "This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3",
        "Email reported by user as malware or phish",
        "azure_security_alert",
        "malicious_session"
    ],
    "streamName": "azure_security_alert"
}