WitFoo-Artifact ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery​] ::: emailFrom=noreply-status@qualys.com ::: created_at=2024-07-16T11:38:11.2532308Z ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-16T11:45:08.24Z","description":"Emails with malicious URL that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-16T11:38:11.2532308Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"db44ab04-4aea-2f0b-5c00-08dca58bbece","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-23T13:52:44.0933333Z","malwareStates":[{"category":null,"family":"de56066a-87f8-48fb-873d-08dca5501f86-7430783637839457266-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[{"applicationName":null,"destinationAddress":null,"destinationDomain":null,"destinationLocation":null,"destinationPort":null,"destinationUrl":"www.atlassian.com/software/statuspage?utm_source=email\u0026utm_medium=powered-by\u0026utm_campaign=status.qualys.com\u0026utm_content=sp-notifications","direction":null,"domainRegisteredDateTime":null,"localDnsName":null,"natDestinationAddress":null,"natDestinationPort":null,"natSourceAddress":null,"natSourcePort":null,"protocol":null,"riskScore":null,"sourceAddress":null,"sourceLocation":null,"sourcePort":null,"status":null,"urlParameters":null}],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=db44ab04-4aea-2f0b-5c00-08dca58bbece"],"status":"inProgress","tags":[],"title":"Email messages containing malicious URL removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"noreply-status","domainName":"qualys.com","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"38.121.101.227","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"noreply-status@qualys.com"},{"aadUserId":null,"accountName":"mike","domainName":"stark.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"mike@stark.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: startTimeUTC=2024-07-16T11:38:11.2532308Z ::: endTimeUTC=2024-07-23T13:52:44.0933333Z ::: streamName=azure_security_alert ::: application=ThreatManagement ::: severityCode=5 ::: messageType=malicious_session ::: serverIP=38.121.101.227 ::: program=azure_security ::: severityLabel=informational ::: emailTo=mike@stark.com
{
    "application": "ThreatManagement",
    "emailfrom": "noreply-status@qualys.com",
    "emailto": "mike@witfoo.com",
    "endtimeutc": "2024-07-23T13:52:44.0933333Z",
    "message": "WitFoo-Artifact ::: tags=[Emails with malicious URL that were delivered and later removed -V1.0.0.3,Email messages containing malicious URL removed after delivery\u200b] ::: emailFrom=noreply-status@qualys.com ::: created_at=2024-07-16T11:38:11.2532308Z ::: message={\"activityGroupName\":null,\"alertDetections\":[],\"assignedTo\":null,\"azureSubscriptionId\":null,\"azureTenantId\":\"4055bd5f-b117-4bb4-befa-de484bd06de8\",\"category\":\"ThreatManagement\",\"closedDateTime\":null,\"cloudAppStates\":[],\"comments\":[\"New alert\"],\"confidence\":null,\"createdDateTime\":\"2024-07-16T11:45:08.24Z\",\"description\":\"Emails with malicious URL that were delivered and later removed -V1.0.0.3\",\"detectionIds\":[],\"eventDateTime\":\"2024-07-16T11:38:11.2532308Z\",\"feedback\":null,\"fileStates\":[],\"historyStates\":[],\"hostStates\":[],\"id\":\"db44ab04-4aea-2f0b-5c00-08dca58bbece\",\"incidentIds\":[],\"investigationSecurityStates\":[],\"lastEventDateTime\":null,\"lastModifiedDateTime\":\"2024-07-23T13:52:44.0933333Z\",\"malwareStates\":[{\"category\":null,\"family\":\"de56066a-87f8-48fb-873d-08dca5501f86-7430783637839457266-1\",\"name\":null,\"severity\":null,\"wasRunning\":null}],\"messageSecurityStates\":[],\"networkConnections\":[{\"applicationName\":null,\"destinationAddress\":null,\"destinationDomain\":null,\"destinationLocation\":null,\"destinationPort\":null,\"destinationUrl\":\"www.atlassian.com/software/statuspage?utm_source=email\\u0026utm_medium=powered-by\\u0026utm_campaign=status.qualys.com\\u0026utm_content=sp-notifications\",\"direction\":null,\"domainRegisteredDateTime\":null,\"localDnsName\":null,\"natDestinationAddress\":null,\"natDestinationPort\":null,\"natSourceAddress\":null,\"natSourcePort\":null,\"protocol\":null,\"riskScore\":null,\"sourceAddress\":null,\"sourceLocation\":null,\"sourcePort\":null,\"status\":null,\"urlParameters\":null}],\"processes\":[],\"recommendedActions\":[],\"registryKeyStates\":[],\"riskScore\":null,\"securityResources\":[],\"severity\":\"informational\",\"sourceMaterials\":[\"https://security.microsoft.com/viewalerts?id=db44ab04-4aea-2f0b-5c00-08dca58bbece\"],\"status\":\"inProgress\",\"tags\":[],\"title\":\"Email messages containing malicious URL removed after delivery\u200b\",\"triggers\":[],\"uriClickSecurityStates\":[],\"userStates\":[{\"aadUserId\":null,\"accountName\":\"noreply-status\",\"domainName\":\"qualys.com\",\"emailRole\":\"sender\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":\"38.121.101.227\",\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"noreply-status@qualys.com\"},{\"aadUserId\":null,\"accountName\":\"mike\",\"domainName\":\"stark.com\",\"emailRole\":\"recipient\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"mike@stark.com\"}],\"vendorInformation\":{\"provider\":\"Office 365 Security and Compliance\",\"providerVersion\":null,\"subProvider\":null,\"vendor\":\"Microsoft\"},\"vulnerabilityStates\":[]} ::: startTimeUTC=2024-07-16T11:38:11.2532308Z ::: endTimeUTC=2024-07-23T13:52:44.0933333Z ::: streamName=azure_security_alert ::: application=ThreatManagement ::: severityCode=5 ::: messageType=malicious_session ::: serverIP=38.121.101.227 ::: program=azure_security ::: severityLabel=informational ::: emailTo=mike@stark.com",
    "messagetype": "malicious_session",
    "program": "azure_security",
    "sampletime": "1.721991728946311E9",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 5,
    "severitylabel": "notice",
    "sourceinfo": "unknown",
    "starttimeutc": "2024-07-16T11:38:11.2532308Z",
    "tags": [
        "Emails with malicious URL that were delivered and later removed -V1.0.0.3",
        "Email messages containing malicious URL removed after delivery\u200b",
        "azure_security_alert",
        "malicious_session"
    ],
    "streamName": "azure_security_alert",
    "serverIP": "38.121.101.227"
}