WitFoo-Artifact ::: messageType=auth_success ::: streamName=DUO Asset Inventory ::: tags=[remembered_device] ::: message={"access_device":{"browser":"DuoWinLogon","browser_version":"4.2.0","epkey":null,"flash_version":null,"hostname":"L-GW08S93","ip":"0.0.0.0","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":"Windows","os_version":"10.0.22000.3079"},"adaptive_trust_assessments":{},"alias":"unknown","application":{"key":"DIR75ZP575GMX3E3CEZE","name":"Microsoft RDP"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T18:44:13.000000+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","result":"success","timestamp":1722019453,"trusted_endpoint_status":"unknown","txid":"95efa37a-b264-457c-8d9e-d72e619972d8","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DUWQWFQH7OOD1V5N65U2","name":"eyanna.tehrani"}} ::: program=cisco_duo
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: auth_success
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['remembered_device', 'DUO Asset Inventory', 'auth_success']