WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760","threatTime":"2023-10-23T14:39:04.000Z","threat":"http://pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html","campaignID":null,"threatType":"url"},{"threatID":"77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e","threatTime":"2023-10-23T13:52:49.000Z","threat":"pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-22T10:44:22.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"CalPrivate Bank - S-INV-0000010319","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","allow_relay","yanroute"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":177623,"headerFrom":"Accounts <ap1@gosmartoffice.com>","headerReplyTo":null,"fromAddress":["ap1@gosmartoffice.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["fyoung@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"attacmeed","sha256":"5ee7ae20cbcc9b78bf31af54831fd206e4fb3db9d0b00d141ece2b6ad056f0d2","md5":"dc6e37ec07372cfb1085aa553e8297a0","filename":null,"sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"attacmeed","sha256":"c275c484ce2d9e99a7499a909ed65b8aefa563ad63089a56c18396709d6eb098","md5":"66b5aeb5915bc33793a8c36288589029","filename":"invoice - 10105008007835  hg0280446.msg","sandboxStatus":"CLEAN","oContentType":"application/vnd.ms-outlook","contentType":"application/vnd.ms-outlook"},{"disposition":"attacmeed","sha256":"edcb807558c1eae66b40ad45d07c66113b6d0b9f8e6c598c6161b0fd76d1374d","md5":"ce530b3dc1e760be597ce185f82f4c53","filename":null,"sandboxStatus":"CLEAN","oContentType":"application/rtf","contentType":"application/rtf"},{"disposition":"attacmeed","sha256":"ba5fff498f2b7d93d285172fc55a99436efbdbf623b27b0fb39974f687536aaf","md5":"a44b8e55204b34f0efca2a4163640d57","filename":"image001.jpg","sandboxStatus":"NOT_SUPPORTED","oContentType":"image/jpeg","contentType":"image/jpeg"},{"disposition":"inline","sha256":"c37fe5a2b5673280ae3054722248261e148f715c3d98cdffceabd2f453326adf","md5":"d3fe2e21f1a5ef9cfc7b4e84a03b44c4","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"a72907405a962641495b6e5846503d821cdc81048b1804caac1f8133dc8b4fcf","md5":"c64a68fe6bc0ce679dc981349dc3a167","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"321f17a3-aa30-ebec-b580-0bc6bea26dc0","QID":"3tvagqgamk-1","GUID":"LM5LS6qUc-IGV1FHmDIS1ByHl4YJqZVy","sender":"ap1@gosmartoffice.com","recipient":["fyoung@acme.bank"],"senderIP":"243.12.33.252","messageID":"<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com>"} ::: fileHash=<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com> ::: fileName=from: ap1@gosmartoffice.com subj: CalPrivate Bank - S-INV-0000010319 ::: serverIP=243.12.33.252 ::: emailFrom=ap1@gosmartoffice.com ::: created_at=2023-10-22T10:44:22.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=CalPrivate Bank - S-INV-0000010319 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-22T10:44:22.000Z ::: emailSendingServer=243.12.33.252 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: ap1@gosmartoffice.com
emailsendingserver: 40.107.243.104
emailsubject: CalPrivate Bank - S-INV-0000010319
filehash: <CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com>
filename: from: ap1@gosmartoffice.com subj: CalPrivate Bank - S-INV-0000010319
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-22T10:44:22.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 243.12.33.252