WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-30T10:14:40.387Z","agent":{"ephemeral_id":"a668c636-ec70-4103-9c98-53517f0df854","id":"040c78f0-1741-4108-a30c-aaf00e9af961","name":"NVIPROCPRDWEB01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"4624","created":"2024-07-30T10:14:42.297Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"NVIPROCPRDWEB01.prdnvi.starkint.com"},"log":{"level":"information"},"message":"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tNVIPROCPRDWEB01$\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t4\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-855572474-1402847513-2951438033-32165\n\tAccount Name:\t\tprocprd-appuser\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x1C5B86AA\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{cbf3a394-d4ce-9622-1544-923035733fe4}\n\nProcess Information:\n\tProcess ID:\t\t0xb08\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tNVIPROCPRDWEB01\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","organization":"stark","senderHost":"10.160.18.44","sensitivity":"normal","winlog":{"activity_id":"{72e70134-d9a9-0000-db01-e772a9d9da01}","api":"wineventlog","channel":"Security","computer_name":"NVIPROCPRDWEB01.prdnvi.starkint.com","event_data":{"AuthenticationPackageName":"Negotiate","ElevatedToken":"%%1842","ImpersonationLevel":"%%1833","IpAddress":"-","IpPort":"-","KeyLength":"0","LmPackageName":"-","LogonGuid":"{cbf3a394-d4ce-9622-1544-923035733fe4}","LogonProcessName":"Advapi  ","LogonType":"4","ProcessId":"0xb08","ProcessName":"C:\\Windows\\System32\\svchost.exe","RestrictedAdminMode":"-","SubjectDomainName":"prdnvi","SubjectLogonId":"0x3e7","SubjectUserName":"NVIPROCPRDWEB01$","SubjectUserSid":"S-1-5-18","TargetDomainName":"prdnvi","TargetLinkedLogonId":"0x0","TargetLogonId":"0x1c5b86aa","TargetOutboundDomainName":"-","TargetOutboundUserName":"-","TargetUserName":"procprd-appuser","TargetUserSid":"S-1-5-21-855572474-1402847513-2951438033-32165","TransmittedServices":"-","VirtualAccount":"%%1843","WorkstationName":"NVIPROCPRDWEB01"},"event_id":"4624","keywords":["Audit Success"],"opcode":"Info","process":{"pid":652,"thread":{"id":1116}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":6493971,"task":"Logon","version":2}}
This is a syslog message from a product called Symantec Data Loss Prevention by Symantec. The following fields were extracted from the message:
fieldExtractorName: symantec_dlp
messageType: data_loss
productIds: [44]
senderHost: 10.160.18.44
sensitivity: normal
sourceInfo: unknown
streamName: symantec_dlp
tags: ['symantec_dlp', 'data_loss']