WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"a05bb57debdd0c410098ba600161bea1b0c3f8e77256b2dd3e1f76beea2d9fc7","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/a05bb57debdd0c410098ba600161bea1b0c3f8e77256b2dd3e1f76beea2d9fc7","threatTime":"2023-07-03T16:25:37.000Z","threat":"r20.rs6.net/tn.jsp?f=001T1HFR_MZB2ngSJi7uNr16lsFTkZg5eUV6zlV1TaoOMpsGQqzyj3eUrRFlmnIsdSHfZKPGtvZjkxMmbiObh4eUmwHdfhbNriIGhvt34tQGsJ6gHOhuHMs6AKUYauNJWnArefp7tziXtBoNpXnrJpQOXtjDX62lFwnOw5HVmeOp9WKmuwmSjVYbg==","campaignID":null,"threatType":"url"}],"messageTime":"2023-07-03T17:48:18.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"(System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank™ Request","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","spf","spam","dmarc","pdr","urldefense"],"messageSize":26137,"headerFrom":"Sandiegoprivatebank Portal Notification™ <info@lesmanoques.com>","headerReplyTo":null,"fromAddress":["info@lesmanoques.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["eflores@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"cf6aa9e7ea507527d93c992e28c3ee6544295f27043cdd963eb8ef85517de738","md5":"60c0c340719d2ba95e8b7c40fa444b09","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"attumbrellaed","sha256":"33a42a3775e4d04fb56d6cf6d097d4d37138ba4150a179ef0e7c2af99c46a567","md5":"98a5421fdd272b5b9a564ea24a104eae","filename":"vs.png","sandboxStatus":null,"oContentType":"image/png","contentType":"image/png"}],"completelyRewritten":false,"id":"9c8650a6-f1bf-0cb9-075b-4326bbb8dfd0","QID":"3rjg0t0m96-1","GUID":"YGqxzfNPFW-hkIVxEFY_rQb9SyGCinSE","sender":"info@lesmanoques.com","recipient":["eflores@sandiegoprivatebank.net"],"senderIP":"142.78.23.4","messageID":"<b1cb5ac1-3bcf-8be6-83da-2463e6edc8d0@lesmanoques.com>"} ::: fileHash=<b1cb5ac1-3bcf-8be6-83da-2463e6edc8d0@lesmanoques.com> ::: fileName=from: info@lesmanoques.com subj: (System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank™ Request ::: serverIP=142.78.23.4 ::: emailFrom=info@lesmanoques.com ::: created_at=2023-07-03T17:48:18.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=(System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank™ Request ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-03T17:48:18.000Z ::: emailSendingServer=142.78.23.4 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "info@lesmanoques.com",
    "emailsendingserver": "217.13.57.247",
    "emailsubject": "(System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank\u2122 Request",
    "filehash": "<b1cb5ac1-3bcf-8be6-83da-2463e6edc8d0@lesmanoques.com>",
    "filename": "from: info@lesmanoques.com subj: (System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank\u2122 Request",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"a05bb57debdd0c410098ba600161bea1b0c3f8e77256b2dd3e1f76beea2d9fc7\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/a05bb57debdd0c410098ba600161bea1b0c3f8e77256b2dd3e1f76beea2d9fc7\",\"threatTime\":\"2023-07-03T16:25:37.000Z\",\"threat\":\"r20.rs6.net/tn.jsp?f=001T1HFR_MZB2ngSJi7uNr16lsFTkZg5eUV6zlV1TaoOMpsGQqzyj3eUrRFlmnIsdSHfZKPGtvZjkxMmbiObh4eUmwHdfhbNriIGhvt34tQGsJ6gHOhuHMs6AKUYauNJWnArefp7tziXtBoNpXnrJpQOXtjDX62lFwnOw5HVmeOp9WKmuwmSjVYbg==\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-07-03T17:48:18.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"(System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank\u2122 Request\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"zerohour\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":26137,\"headerFrom\":\"Sandiegoprivatebank Portal Notification\u2122 <info@lesmanoques.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"info@lesmanoques.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"eflores@sandiegoprivatebank.net\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"cf6aa9e7ea507527d93c992e28c3ee6544295f27043cdd963eb8ef85517de738\",\"md5\":\"60c0c340719d2ba95e8b7c40fa444b09\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"attumbrellaed\",\"sha256\":\"33a42a3775e4d04fb56d6cf6d097d4d37138ba4150a179ef0e7c2af99c46a567\",\"md5\":\"98a5421fdd272b5b9a564ea24a104eae\",\"filename\":\"vs.png\",\"sandboxStatus\":null,\"oContentType\":\"image/png\",\"contentType\":\"image/png\"}],\"completelyRewritten\":false,\"id\":\"9c8650a6-f1bf-0cb9-075b-4326bbb8dfd0\",\"QID\":\"3rjg0t0m96-1\",\"GUID\":\"YGqxzfNPFW-hkIVxEFY_rQb9SyGCinSE\",\"sender\":\"info@lesmanoques.com\",\"recipient\":[\"eflores@sandiegoprivatebank.net\"],\"senderIP\":\"142.78.23.4\",\"messageID\":\"<b1cb5ac1-3bcf-8be6-83da-2463e6edc8d0@lesmanoques.com>\"} ::: fileHash=<b1cb5ac1-3bcf-8be6-83da-2463e6edc8d0@lesmanoques.com> ::: fileName=from: info@lesmanoques.com subj: (System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank\u2122 Request ::: serverIP=142.78.23.4 ::: emailFrom=info@lesmanoques.com ::: created_at=2023-07-03T17:48:18.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=(System_Reminder): July 3, 2023, 10:48:11 AM | eflores@sandiegoprivatebank.net | Sandiegoprivatebank\u2122 Request ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-03T17:48:18.000Z ::: emailSendingServer=142.78.23.4 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-07-03T17:48:18.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "142.78.23.4"
}