WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"4227b6da3e22986aa2fad3b8d416c2e42064b8a13aaf940e06ad5ef027baad73","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/4227b6da3e22986aa2fad3b8d416c2e42064b8a13aaf940e06ad5ef027baad73","threatTime":"2023-09-14T12:18:22.000Z","threat":"vedgoved.com","campaignID":null,"threatType":"url"}],"messageTime":"2023-09-14T11:17:34.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"2023 Budget Spreadsheet Updates","quarantineFolder":"Quarantine","quarantineRule":"inbound_spam","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":14420,"headerFrom":"Harry Owner <harry@vedgoved.com>","headerReplyTo":"Harry Owner <harry@vedgoved.com>","fromAddress":["harry@vedgoved.com"],"ccAddresses":[],"replyToAddress":["fb42c054aa52cad2a2de29209777d961@vedgoved.com>"],"toAddresses":["vvanacore@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"b837b1865608f46f24192eac6e8083e0e46e92b2b8a9cf40b21f374f3b0b1bff","md5":"d78fe20244d34201863450bf3fd9bfa8","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"e2bdcdf3a0b8ca16566a38326853b7ae4c61ad96b8c809fe6c83f2aad8138e26","md5":"b6006f1bec4210ba07710f265351c641","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"4f7f231d-a14c-b03b-6c8a-65b778bc1635","QID":"3t2y8frpxs-1","GUID":"xvCSIHL-N8k7ZELnKgqGzjgcrSrTAHs4","sender":"harry@vedgoved.com","recipient":["vvanacore@umbrella.bank"],"senderIP":"59.71.250.145","messageID":"<4ukzh3kzv0li.R2wL-bB6x8b-omueETlkPA2@tracking.vedgoved.com>"} ::: fileHash=<4ukzh3kzv0li.R2wL-bB6x8b-omueETlkPA2@tracking.vedgoved.com> ::: fileName=from: harry@vedgoved.com subj: 2023 Budget Spreadsheet Updates ::: serverIP=59.71.250.145 ::: emailFrom=harry@vedgoved.com ::: created_at=2023-09-14T11:17:34.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=2023 Budget Spreadsheet Updates ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-09-14T11:17:34.000Z ::: emailSendingServer=59.71.250.145 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: harry@vedgoved.com
emailsendingserver: 51.222.89.28
emailsubject: 2023 Budget Spreadsheet Updates
filehash: <4ukzh3kzv0li.R2wL-bB6x8b-omueETlkPA2@tracking.vedgoved.com>
filename: from: harry@vedgoved.com subj: 2023 Budget Spreadsheet Updates
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-09-14T11:17:34.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 59.71.250.145