WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"ea858cd4434699d56cdacf37e979904db381b0db86a6a3634f0a7e5bbcfed496","threatStatus":"active","classification":"impostor","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ea858cd4434699d56cdacf37e979904db381b0db86a6a3634f0a7e5bbcfed496","threatTime":"2023-04-11T20:33:45.000Z","threat":"nas@infotech.pf:td9D-GMm0zUihgPLdimG8rA3cKN62fl_","campaignID":null,"threatType":"messageText"}],"messageTime":"2023-04-11T20:33:44.000Z","impostorScore":100,"malwareScore":0,"cluster":"acme_hosted","subject":"LinkedIn Invoice","quarantineFolder":"Impostor","quarantineRule":"inbound_impostor","policyRoutes":["default_inbound","yanroute"],"modulesRun":["av","zerohour","spf","spam","dmarc","pdr","urldefense"],"messageSize":4832,"headerFrom":"Rick Sowers <nas@infotech.pf>","headerReplyTo":null,"fromAddress":["nas@infotech.pf"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["rsujeeth@acme.bank"],"xmailer":"Zimbra 8.8.15_GA_4464 (ZimbraWebClient - GC111 (Win)/8.8.15_GA_4468)","messageParts":[{"disposition":"inline","sha256":"f04c8febdae0ba394242148cbf2d15aa85150d85d8d65bb5030dbd8dc4cd5768","md5":"da0c770772b7eb21ab230272618b2f7b","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"e195b9cf34ccf8e9fd3c7db4d2637e2b6e03065a00203145cdeceb7f34c79fa0","md5":"30a4e0d9aae5374965eb80633ae8725b","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"3834e7e9-e272-e19b-092b-26c7d6dd2cc6","QID":"3pu6nj183q-1","GUID":"td9D-GMm0zUihgPLdimG8rA3cKN62fl_","sender":"nas@infotech.pf","recipient":["rsujeeth@acme.bank"],"senderIP":"177.21.45.25","messageID":"<1708217942.1292192.1681245218514.JavaMail.zimbra@infotech.pf>"} ::: fileHash=<1708217942.1292192.1681245218514.JavaMail.zimbra@infotech.pf> ::: fileName=from: nas@infotech.pf subj: LinkedIn Invoice ::: serverIP=177.21.45.25 ::: emailFrom=nas@infotech.pf ::: created_at=2023-04-11T20:33:44.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=LinkedIn Invoice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-04-11T20:33:44.000Z ::: emailSendingServer=177.21.45.25 ::: pipelineEntrypoint=dispatch
{
    "emailsubject": "LinkedIn Invoice",
    "senderhost": "localhost",
    "severitylabel": "critical",
    "starttimeutc": "2023-04-11T20:33:44.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "productids": [
        32
    ],
    "filename": "from: nas@infotech.pf subj: LinkedIn Invoice",
    "severitycode": 2,
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"ea858cd4434699d56cdacf37e979904db381b0db86a6a3634f0a7e5bbcfed496\",\"threatStatus\":\"active\",\"classification\":\"impostor\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ea858cd4434699d56cdacf37e979904db381b0db86a6a3634f0a7e5bbcfed496\",\"threatTime\":\"2023-04-11T20:33:45.000Z\",\"threat\":\"nas@infotech.pf:td9D-GMm0zUihgPLdimG8rA3cKN62fl_\",\"campaignID\":null,\"threatType\":\"messageText\"}],\"messageTime\":\"2023-04-11T20:33:44.000Z\",\"impostorScore\":100,\"malwareScore\":0,\"cluster\":\"acme_hosted\",\"subject\":\"LinkedIn Invoice\",\"quarantineFolder\":\"Impostor\",\"quarantineRule\":\"inbound_impostor\",\"policyRoutes\":[\"default_inbound\",\"yanroute\"],\"modulesRun\":[\"av\",\"zerohour\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":4832,\"headerFrom\":\"Rick Sowers <nas@infotech.pf>\",\"headerReplyTo\":null,\"fromAddress\":[\"nas@infotech.pf\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"rsujeeth@acme.bank\"],\"xmailer\":\"Zimbra 8.8.15_GA_4464 (ZimbraWebClient - GC111 (Win)/8.8.15_GA_4468)\",\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"f04c8febdae0ba394242148cbf2d15aa85150d85d8d65bb5030dbd8dc4cd5768\",\"md5\":\"da0c770772b7eb21ab230272618b2f7b\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"e195b9cf34ccf8e9fd3c7db4d2637e2b6e03065a00203145cdeceb7f34c79fa0\",\"md5\":\"30a4e0d9aae5374965eb80633ae8725b\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"}],\"completelyRewritten\":false,\"id\":\"3834e7e9-e272-e19b-092b-26c7d6dd2cc6\",\"QID\":\"3pu6nj183q-1\",\"GUID\":\"td9D-GMm0zUihgPLdimG8rA3cKN62fl_\",\"sender\":\"nas@infotech.pf\",\"recipient\":[\"rsujeeth@acme.bank\"],\"senderIP\":\"177.21.45.25\",\"messageID\":\"<1708217942.1292192.1681245218514.JavaMail.zimbra@infotech.pf>\"} ::: fileHash=<1708217942.1292192.1681245218514.JavaMail.zimbra@infotech.pf> ::: fileName=from: nas@infotech.pf subj: LinkedIn Invoice ::: serverIP=177.21.45.25 ::: emailFrom=nas@infotech.pf ::: created_at=2023-04-11T20:33:44.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=LinkedIn Invoice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-04-11T20:33:44.000Z ::: emailSendingServer=177.21.45.25 ::: pipelineEntrypoint=dispatch",
    "sensitivity": "normal",
    "emailsendingserver": "202.3.225.166",
    "messagetype": "email_protection_event",
    "emailfrom": "nas@infotech.pf",
    "sourceinfo": "unknown",
    "filehash": "<1708217942.1292192.1681245218514.JavaMail.zimbra@infotech.pf>",
    "vendorcode": "blocked_message",
    "action": "block",
    "streamName": "proofpoint_protect",
    "serverIP": "177.21.45.25"
}