WitFoo-Artifact ::: message={"actor":{"alternateId":"charlie","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxDOZ3MPkUSKO9L5A4PNWfvg","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.8003,"lon":-117.2438},"postalCode":"92109","state":"California"},"id":null,"ipAddress":"153.167.54.218","userAgent":{"browser":"CHROME","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs17a.auw2-ok14.internal//1707493923432//43cafbcb3d0e3013c1cc95ba3fc94f96:ec143e95-c742-4d6a-8a54-237a09a340c5:","agentid":"a539kiyvwggVTfYyD697","authnRequestId":"e2f918081470c42b3d3a75c43cebca72","delauthtimeout":"4000","delauthtimespentatagent":"172","delauthtimespentatdomaincontroller":"172","delauthtimetotal":"461","deviceFingerprint":"f7a6c7c4b916021a7f757b65abce2480","dtHash":"22a29f1da539ffdf3335a44f6dec6b49db17a6517d984de05edb8996bfebfab4","errorCode":"1326","requestId":"43cafbcb3d0e3013c1cc95ba3fc94f96","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T15:51:59.893Z","request":{"ipChain":[{"geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.8003,"lon":-117.2438},"postalCode":"92109","state":"California"},"ip":"153.167.54.218","source":null,"version":"V4"}]},"securityContext":{"asNumber":3356,"asOrg":"level 3 parent  llc","domain":"level3.net","isProxy":false,"isp":"level 3 parent  llc"},"severity":"ERROR","target":[{"alternateId":"Mcampion@wayne.bank","detailEntry":null,"displayName":"Mary Campion","id":"0ua16z1jzrfvgvAFL697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"43cafbcb3d0e3013c1cc95ba3fc94f96","type":"WEB"},"uuid":"2904bd44-c763-11ee-8200-89111b4472be","version":"0"} ::: clientIP=153.167.54.218 ::: program=okta ::: severityCode=2 ::: severityLabel=ERROR ::: streamName=Okta ::: userName=charlie ::: action=FAILURE ::: messageType=auth_failure
Product: Okta
Vendor: Okta