WitFoo-Artifact ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-05T15:02:00Z","description":"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-05T15:02:00Z","feedback":null,"fileStates":[],"historyStates":[],"hostStates":[],"id":"74858cdc-8ff5-f332-5f8d-08dc9d035933","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-05T16:21:05.66Z","malwareStates":[],"messageSecurityStates":[],"networkConnections":[],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"low","sourceMaterials":["https://security.microsoft.com/viewalerts?id=74858cdc-8ff5-f332-5f8d-08dc9d035933"],"status":"resolved","tags":[],"title":"Email reported by user as malware or phish","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"charles","domainName":"umbrella.com","emailRole":"unknown","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"charles@umbrella.com"},{"aadUserId":null,"accountName":"quickbooks","domainName":"notification.intuit.com","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"70.0.16.196","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"quickbooks@notification.intuit.com"},{"aadUserId":null,"accountName":"charles","domainName":"umbrella.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"charles@umbrella.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: program=azure_security ::: tags=[This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3,Email reported by user as malware or phish] ::: streamName=azure_security_alert ::: endTimeUTC=2024-07-05T16:21:05.66Z ::: emailFrom=quickbooks@notification.intuit.com ::: messageType=malicious_session ::: emailTo=charles@umbrella.com ::: severityCode=4 ::: serverIP=70.0.16.196 ::: startTimeUTC=2024-07-05T15:02:00Z ::: created_at=2024-07-05T15:02:00Z ::: application=ThreatManagement ::: severityLabel=low
Product: Azure Security
Vendor: Microsoft