WitFoo-Artifact ::: program=microsoft_graph ::: message={"businessPhones":[],"displayName":"Accounts Payable Mailbox","givenName":"AccountsPayable","id":"579a770b-823c-4b35-becc-34e6dcdeb11d","jobTitle":"Accounts Payable Mailbox","mail":"accountspayable@stark.org","mobilePhone":null,"officeLocation":null,"preferredLanguage":null,"surname":null,"userPrincipalName":"nighthawk"} ::: userName=nighthawk ::: streamName=Microsoft Graph Asset Inventory ::: messageType=asset_inventory ::: tags=[mail=accountspayable@stark.org,jobTitle=Accounts Payable Mailbox,givenName=AccountsPayable,displayName=Accounts Payable Mailbox]
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: microsoft_graph
senderHost: WitFoo-Streamer2.uwca.org
sensitivity: normal
sourceInfo: unknown
streamName: Microsoft Graph Asset Inventory
tags: ['givenName=AccountsPayable', 'mail=accountspayable@uwca.org', 'jobTitle=Accounts Payable Mailbox', 'asset_inventory', 'Microsoft Graph Asset Inventory', 'displayName=Accounts Payable Mailbox']
userName: nighthawk