WitFoo-Artifact ::: streamName=azure_security_alert ::: created_at=2024-07-16T11:32:48.9578132Z ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-16T11:34:04.8433333Z","description":"Emails with malicious URL that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-16T11:32:48.9578132Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"db44ab04-4aea-2f0b-b800-08dca58ae83a","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-23T13:52:44.0933333Z","malwareStates":[{"category":null,"family":"1593a75a-ee69-4919-02a4-08dca51f50bc-7430783637839457266-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"www.atlassian.com/software/statuspage?utm_source=email\u0026utm_medium=powered-by\u0026utm_campaign=status.qualys.com\u0026utm_content=sp-notifications","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null}],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=db44ab04-4aea-2f0b-b800-08dca58ae83a"],"status":"inProgress","tags":[],"title":"Email messages containing malicious URL removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"noreply-status","domainName":"qualys.com","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"228.231.24.55","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"noreply-status@qualys.com"},{"aadUserId":null,"accountName":"mike","domainName":"wayne.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"mike@wayne.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: severityLabel=informational ::: emailTo=mike@wayne.com ::: startTimeUTC=2024-07-16T11:32:48.9578132Z ::: program=azure_security ::: serverIP=228.231.24.55 ::: emailFrom=noreply-status@qualys.com ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery​] ::: messageType=malicious_session ::: application=ThreatManagement ::: severityCode=5 ::: endTimeUTC=2024-07-23T13:52:44.0933333Z
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
application: ThreatManagement
emailfrom: noreply-status@qualys.com
emailto: mike@witfoo.com
endtimeutc: 2024-07-23T13:52:44.0933333Z
messagetype: malicious_session
program: azure_security
senderhost: kafka.precinct
sensitivity: normal
severitycode: 5
severitylabel: notice
sourceinfo: unknown
starttimeutc: 2024-07-16T11:32:48.9578132Z
tags: ['Emails with malicious URL that were delivered and later removed -V1.0.0.3', 'Email messages containing malicious URL removed after delivery\u200b', 'azure_security_alert', 'malicious_session']
streamName: azure_security_alert
serverIP: 228.231.24.55