WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","threatTime":"2023-08-29T22:30:30.000Z","threat":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-08-29T22:31:33.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","spf","sandbox","spam","dmarc","urldefense"],"messageSize":64324,"headerFrom":"\"AP Inquiries_MAILBOXACCOUNTSPAYABLE@Calprivate\" <stephan.witolla@jobticket.de>","headerReplyTo":null,"fromAddress":["stephan.witolla@jobticket.de"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["security@Calprivate.bank"],"xmailer":null,"messageParts":[{"disposition":"attumbrellaed","sha256":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","md5":"9d613f0f93cda7c1b477392ffdfd7252","filename":"w9&statement_advice_for_umbrella.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"2c70e331ae843595a68283f2fe61b2d0fc2663bf73aa3ff5eb788dd88b884d3b","md5":"04a8c8326c207e11ad625ad34ea4bbdc","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"5c7279e3-0777-8f66-3926-f216efc6f7e1","QID":"3sqfsc1d7h-1","GUID":"w2R6kx3kMblgVlxLXZUBG9hTUJBq3wFv","sender":"stephan.witolla@jobticket.de","recipient":["security@umbrella.bank"],"senderIP":"202.169.49.8","messageID":"<169334821164.8788.14712446091347986247@jobticket.de>"} ::: fileHash=<169334821164.8788.14712446091347986247@jobticket.de> ::: fileName=from: stephan.witolla@jobticket.de subj: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: serverIP=202.169.49.8 ::: emailFrom=stephan.witolla@jobticket.de ::: created_at=2023-08-29T22:31:33.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-29T22:31:33.000Z ::: emailSendingServer=202.169.49.8 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: stephan.witolla@jobticket.de
emailsendingserver: 212.227.126.135
emailsubject: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM
filehash: <169334821164.8788.14712446091347986247@jobticket.de>
filename: from: stephan.witolla@jobticket.de subj: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-08-29T22:31:33.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 202.169.49.8