WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3","threatTime":"2023-06-23T04:18:47.000Z","threat":"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-06-26T01:13:06.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","spf","sandbox","spam","dmarc","pdr","urldefense"],"messageSize":31981,"headerFrom":"Accounts Calprivate <Joseph.Henk@jci.com>","headerReplyTo":null,"fromAddress":["joseph.henk@jci.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["rpedersen@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"275233729762fe46b66227a0d5f0b40d5b8ff40c1a9df68ac958ed89d2dcbd2f","md5":"f532929390f96b1a2debd88dc3bc1a4c","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"},{"disposition":"attumbrellaed","sha256":"43e918efc000e59a5ed62afdf1b2fa092f1aeac903835cf0201231fe1ebd3056","md5":"02d49126025609a94e7c0c03ec4e3757","filename":"umbrella","sandboxStatus":"NOT_SUPPORTED","oContentType":"image/png","contentType":"image/png"},{"disposition":"inline","sha256":"688787fbb991b11b4e767d01c6da762e35a9aa8fdf3b2e74bf44d658f04c3067","md5":"ec92700e9dd452ac45503ce6e98f11a3","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"attumbrellaed","sha256":"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3","md5":"b2371b4e17599e4f872b866d1d41ef3f","filename":"umbrella-eftpaymentcopy.htm","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"ac493c89-68a8-f01d-41fa-1da64e6e9c41","QID":"3rdxvf8g38-1","GUID":"QTURiplQITabDguJ7q4jq3EY1oLw-nve","sender":"joseph.henk@jci.com","recipient":["rpedersen@umbrella.bank"],"senderIP":"128.202.72.197","messageID":"<f72ab22eb64af3a1beaf168a21f221b3@WIN-QKTRFVG35N>"} ::: fileHash=<f72ab22eb64af3a1beaf168a21f221b3@WIN-QKTRFVG35N> ::: fileName=from: joseph.henk@jci.com subj: Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023 ::: serverIP=128.202.72.197 ::: emailFrom=joseph.henk@jci.com ::: created_at=2023-06-26T01:13:06.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-26T01:13:06.000Z ::: emailSendingServer=128.202.72.197 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "joseph.henk@jci.com",
    "emailsendingserver": "74.208.4.196",
    "emailsubject": "Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023",
    "filehash": "<f72ab22eb64af3a1beaf168a21f221b3@WIN-QKTRFVG35N>",
    "filename": "from: joseph.henk@jci.com subj: Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3\",\"threatTime\":\"2023-06-23T04:18:47.000Z\",\"threat\":\"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3\",\"campaignID\":null,\"threatType\":\"attumbrellament\"}],\"messageTime\":\"2023-06-26T01:13:06.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023\",\"quarantineFolder\":\"Attumbrellament Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"zerohour\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":31981,\"headerFrom\":\"Accounts Calprivate <Joseph.Henk@jci.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"joseph.henk@jci.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"rpedersen@umbrella.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"275233729762fe46b66227a0d5f0b40d5b8ff40c1a9df68ac958ed89d2dcbd2f\",\"md5\":\"f532929390f96b1a2debd88dc3bc1a4c\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"attumbrellaed\",\"sha256\":\"43e918efc000e59a5ed62afdf1b2fa092f1aeac903835cf0201231fe1ebd3056\",\"md5\":\"02d49126025609a94e7c0c03ec4e3757\",\"filename\":\"umbrella\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"image/png\",\"contentType\":\"image/png\"},{\"disposition\":\"inline\",\"sha256\":\"688787fbb991b11b4e767d01c6da762e35a9aa8fdf3b2e74bf44d658f04c3067\",\"md5\":\"ec92700e9dd452ac45503ce6e98f11a3\",\"filename\":\"text.txt\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"attumbrellaed\",\"sha256\":\"bc3352a3a4b02eb35cec656b79d429078ecf6cb477fcc8759d4ade656565eeb3\",\"md5\":\"b2371b4e17599e4f872b866d1d41ef3f\",\"filename\":\"umbrella-eftpaymentcopy.htm\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"ac493c89-68a8-f01d-41fa-1da64e6e9c41\",\"QID\":\"3rdxvf8g38-1\",\"GUID\":\"QTURiplQITabDguJ7q4jq3EY1oLw-nve\",\"sender\":\"joseph.henk@jci.com\",\"recipient\":[\"rpedersen@umbrella.bank\"],\"senderIP\":\"128.202.72.197\",\"messageID\":\"<f72ab22eb64af3a1beaf168a21f221b3@WIN-QKTRFVG35N>\"} ::: fileHash=<f72ab22eb64af3a1beaf168a21f221b3@WIN-QKTRFVG35N> ::: fileName=from: joseph.henk@jci.com subj: Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023 ::: serverIP=128.202.72.197 ::: emailFrom=joseph.henk@jci.com ::: created_at=2023-06-26T01:13:06.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Funds Transfer Confirmation - EFT RemittanceCopy Calprivate On 26/06/2023 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-26T01:13:06.000Z ::: emailSendingServer=128.202.72.197 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-06-26T01:13:06.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "128.202.72.197"
}