WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.acme.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad is about to expire or already expired.","organization":"acme","senderHost":"nordc-app-fs01.acme.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.acme.com","event_data":{"Context":"local system","ObjId":"a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284642,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:20:09.001Z\",\"agent\":{\"ephemeral_id\":\"9e8b3684-f98e-4660-a5f0-b9055e0435e9\",\"id\":\"60a0a7eb-8adf-44b2-8571-636680a0f5cd\",\"name\":\"NORDC-APP-FS01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T13:20:09.148Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-FS01.acme.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad is about to expire or already expired.\",\"organization\":\"acme\",\"senderHost\":\"nordc-app-fs01.acme.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-FS01.acme.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":1284642,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "nordc-app-fs01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "1284642"
}