WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"5ff0a1a5e95b5d03d5d1821bbe1b09ce68a03ad6b21fc2ae768c8d70206cd76a","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5ff0a1a5e95b5d03d5d1821bbe1b09ce68a03ad6b21fc2ae768c8d70206cd76a","threatTime":"2023-07-04T18:06:26.000Z","threat":"https://windjs.netlify.app/img/download.webp","campaignID":null,"threatType":"url"},{"threatID":"960b25370c8a7f5418a15c78f207f8b96756bdc188820014f1723a951da75ebd","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/960b25370c8a7f5418a15c78f207f8b96756bdc188820014f1723a951da75ebd","threatTime":"2023-08-11T19:44:21.000Z","threat":"960b25370c8a7f5418a15c78f207f8b96756bdc188820014f1723a951da75ebd","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-08-12T06:42:46.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Merchant Credit on your Account","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","spf","sandbox","spam","dmarc","pdr","urldefense"],"messageSize":168774,"headerFrom":"American Express <UService@interus.com>","headerReplyTo":null,"fromAddress":["uservice@interus.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["rpedersen@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"960d4ab6f4ffd8bae9b88aee05cb7e77228e4599a4c24b2a613ca84772abd4b3","md5":"bd0252c4116b30da7fcab2dada732603","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"},{"disposition":"attumbrellaed","sha256":"c0a5d4abddcf6f9bef7c42980638a14673a6d5e166295ddf3713d31ee086ce9a","md5":"8a807599707748147b851a993af763c7","filename":"mail","sandboxStatus":"NOT_SUPPORTED","oContentType":"image/jpeg","contentType":"image/jpeg"},{"disposition":"attumbrellaed","sha256":"960b25370c8a7f5418a15c78f207f8b96756bdc188820014f1723a951da75ebd","md5":"aae8765dbc6a9c7128c1867be996a388","filename":"merchant credit available  (american express) doc.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"021f681b-6875-8926-a691-95799d0a9354","QID":"3se4b080ac-1","GUID":"RwTXoaKSc_5jGBtKT0R1OxqD4D6hcxgr","sender":"uservice@interus.com","recipient":["rpedersen@umbrella.bank"],"senderIP":"199.168.125.88","messageID":"<20230811234159.FC5BF1972639D399@interus.com>"} ::: fileHash=<20230811234159.FC5BF1972639D399@interus.com> ::: fileName=from: uservice@interus.com subj: Merchant Credit on your Account ::: serverIP=199.168.125.88 ::: emailFrom=uservice@interus.com ::: created_at=2023-08-12T06:42:46.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Merchant Credit on your Account ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-12T06:42:46.000Z ::: emailSendingServer=199.168.125.88 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: uservice@interus.com
emailsendingserver: 24.234.165.55
emailsubject: Merchant Credit on your Account
filehash: <20230811234159.FC5BF1972639D399@interus.com>
filename: from: uservice@interus.com subj: Merchant Credit on your Account
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-08-12T06:42:46.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 199.168.125.88