WitFoo-Artifact ::: tags=["title=CPB - Failed Suspicious Login","description=Failed Suspicious Login Has Been Detected","detail=undefined"] ::: action=blocked ::: message={"id":"a82322e4ecf62dca2d2a1ebcbba206c1","tenant_id":"tenant_a41e6a657eef469dbfe7b26dbeeb4827","timestamp":1691673657563,"severity":"LOW","title":"CPB - Failed Suspicious Login","description":"Failed Suspicious Login Has Been Detected","type":"Footprint","sub_type":"Suspicious Login","related_events":[{"event_id":"850f62ae6c5d4ea88eb22bbf7a2fbe3a","cloud_service":"Office 365","timestamp":1691673252000,"user_id":"user_1c4fc0dc6647d32f789049fdccfbe4a0","user_email":"charlie","full_name":"Monica Elizabeth Navarro","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36","location":"United States of America, Ohio, Dayton","geo_location":[-84.191650390625,39.75894546508789],"intelligence":[{"ip_address":"33.201.103.201"}],"event_classification":{"id":"9852","category":"Suspicious Login","sub_category":"Suspicious Login","threat":"Authentication"},"meta_data":{"extracted_fields":[{"129064":"[\"50\"]"},{"129065":"[\"Failure\"]"},{"129067":"[\"Suspicious login attempt detected for charlie, from Bruteforcer 33.201.103.201 (AT&T Internet Services) \\n\\nThreat intelligence: \\nProofpoint CASB | IP Last Seen On: 2023-08-10\\nProofpoint CASB | Categories: Bruteforcer\\nIP Enrichments | Usage Type: ISP/MOB\\nIP Enrichments | Domain: att.net\"]"},{"129068":"[\"Low\"]"}]}}]} ::: program=Office 365 ::: clientIP=33.201.103.201 ::: userName=charlie ::: geoRegion=United States of America, Ohio, Dayton ::: created_at=1691673657563 ::: streamName=proofpoint_casb ::: vendorCode=9852 ::: messageType=auth_failure ::: pipelineName=proofpoint_casb ::: severityCode=4 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called CASB by ProofPoint. The following fields were extracted from the message:
action: block
georegion: United States of America, Ohio, Dayton
messagetype: auth_failure
productids: [6]
program: Office 365
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
tags: ['description=Failed Suspicious Login Has Been Detected', 'proofpoint_casb', 'title=CPB - Failed Suspicious Login', 'detail=undefined', 'auth_failure']
vendorcode: 9852
streamName: proofpoint_casb
clientIP: 33.201.103.201
userName: charlie