WitFoo-Artifact ::: tags=["title=CPB - Failed Suspicious Login","description=Failed Suspicious Login Has Been Detected","detail=undefined"] ::: action=blocked ::: message={"id":"55947cf5f4c84d8107263cb26884bdbc","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1703716556846,"severity":"LOW","title":"CPB - Failed Suspicious Login","description":"Failed Suspicious Login Has Been Detected","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"230b77638cbd9e5b98c2fe59101fc7ea","cloud_service":"Office 365","timestamp":1703716315000,"user_id":"user_11c2cc7851a92e8fa0cbfc35d063c74d","user_email":"nighthawk","full_name":"Richard Smith","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36","location":"Russian Federation, Permskiy kray, Perm","geo_location":[56.28534698486328,58.01765060424805],"intelligence":[{"ip_address":"250.133.198.184"}],"event_classification":{"id":"9852","category":"Suspicious Login","sub_category":"Suspicious Login","threat":"Authentication"},"meta_data":{"extracted_fields":[{"129064":"[\"50\"]"},{"129065":"[\"Failure\"]"},{"129067":"[\"Suspicious login attempt detected for nighthawk, from Bruteforcer 250.133.198.184 (JSC ER-Telecom Holding) \\n\\nThreat intelligence: \\nProofpoint CASB | IP Last Seen On: 2023-12-27\\nProofpoint CASB | Categories: Bruteforcer\\nIP Enrichments | Usage Type: ISP (Fixed Line ISP)\\nIP Enrichments | Domain: ertelecom.ru\\n\\nBehavioral indicators for nighthawk: \\nRare country score: High (common country: United States)\\nRare user agent score: High (common user agent: ios/16.6//mobile safari////iphone/apple)\\nRare isp score: High (common isp: T-Mobile USA Inc.)\"]"},{"129068":"[\"Low\"]"}]}}]} ::: program=Office 365 ::: clientIP=250.133.198.184 ::: userName=nighthawk ::: geoRegion=Russian Federation, Permskiy kray, Perm ::: created_at=1703716556846 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "georegion": "Russian Federation, Permskiy kray, Perm",
    "message": "WitFoo-Artifact ::: tags=[\"title=CPB - Failed Suspicious Login\",\"description=Failed Suspicious Login Has Been Detected\",\"detail=undefined\"] ::: action=blocked ::: message={\"id\":\"55947cf5f4c84d8107263cb26884bdbc\",\"tenant_id\":\"tenant_a41e6a657eef469dbfe7b26dbeeb4827\",\"timestamp\":1703716556846,\"severity\":\"LOW\",\"title\":\"CPB - Failed Suspicious Login\",\"description\":\"Failed Suspicious Login Has Been Detected\",\"type\":\"Footprint\",\"sub_type\":\"Suspicious Login\",\"related_events\":[{\"event_id\":\"230b77638cbd9e5b98c2fe59101fc7ea\",\"cloud_service\":\"Office 365\",\"timestamp\":1703716315000,\"user_id\":\"user_11c2cc7851a92e8fa0cbfc35d063c74d\",\"user_email\":\"nighthawk\",\"full_name\":\"Richard Smith\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36\",\"location\":\"Russian Federation, Permskiy kray, Perm\",\"geo_location\":[56.28534698486328,58.01765060424805],\"intelligence\":[{\"ip_address\":\"250.133.198.184\"}],\"event_classification\":{\"id\":\"9852\",\"category\":\"Suspicious Login\",\"sub_category\":\"Suspicious Login\",\"threat\":\"Authentication\"},\"meta_data\":{\"extracted_fields\":[{\"129064\":\"[\\\"50\\\"]\"},{\"129065\":\"[\\\"Failure\\\"]\"},{\"129067\":\"[\\\"Suspicious login attempt detected for nighthawk, from Bruteforcer 250.133.198.184 (JSC ER-Telecom Holding) \\\\n\\\\nThreat intelligence: \\\\nProofpoint CASB | IP Last Seen On: 2023-12-27\\\\nProofpoint CASB | Categories: Bruteforcer\\\\nIP Enrichments | Usage Type: ISP (Fixed Line ISP)\\\\nIP Enrichments | Domain: ertelecom.ru\\\\n\\\\nBehavioral indicators for nighthawk: \\\\nRare country score: High (common country: United States)\\\\nRare user agent score: High (common user agent: ios/16.6//mobile safari////iphone/apple)\\\\nRare isp score: High (common isp: T-Mobile USA Inc.)\\\"]\"},{\"129068\":\"[\\\"Low\\\"]\"}]}}]} ::: program=Office 365 ::: clientIP=250.133.198.184 ::: userName=nighthawk ::: geoRegion=Russian Federation, Permskiy kray, Perm ::: created_at=1703716556846 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "program": "Office 365",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "tags": [
        "description=Failed Suspicious Login Has Been Detected",
        "proofpoint_casb",
        "title=CPB - Failed Suspicious Login",
        "detail=undefined",
        "auth_failure"
    ],
    "vendorcode": "9852",
    "streamName": "proofpoint_casb",
    "clientIP": "250.133.198.184",
    "userName": "nighthawk"
}