<110>2024-07-26T23:16:40.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = FIMAuditReports ]  [ REPORT_PROFILE = Network share Read ]  [ EVENT_NUMBER = 5140 ]  [ TIME_GENERATED = 1722050200 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = NORDC-APP-FS01 ]  [ REMARKS = A network share object was accessed. ]  [ HANDLE_ID = null ]  [ OBJECT_NAME = \??\D:\Holden ]  [ UNC_NAME = \\*\Holden ]  [ FILE_NAME = Holden ]  [ FILE_LOCATION = \??\D:\ ]  [ LOGON_ID = 0x7f7c8906c ]  [ DOMAIN = acme.com ]  [ ACCESSES = ReadData (or ListDirectory) ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ TRANSACTION_ID = null ]  [ ACCESS_MASK = 1 ]  [ USERNAME = SHoward ]  [ RECORD_NUMBER = 4221394974 ]  [ USER_SID = S-1-5-21-1725571127-999974082-2044928816-19496 ]  [ ACCESS_TYPE = 1 ]  [ ACCESS_TYPE_TEXT = File/Folder Read ]  [ FORMAT_MESSAGE = User 'SHoward' Read file/folder '\??\D:\Holden'. ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = Cliff Howard ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = CN=Howard\, Cliff,OU=Dothan Desktop Users,OU=Region-Gulf Coast Desktop Users,OU=MDS-ATL Desktop User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ USER_OU_GUID = {DD158112-BACME-4B19-BB9D-672434AACF48} ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = Folder ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ NEW_PRIVILEGES_USED = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-26T23:16:40.000-04:00",
    "message": "<110>2024-07-26T23:16:40.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = FIMAuditReports ]  [ REPORT_PROFILE = Network share Read ]  [ EVENT_NUMBER = 5140 ]  [ TIME_GENERATED = 1722050200 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = NORDC-APP-FS01 ]  [ REMARKS = A network share object was accessed. ]  [ HANDLE_ID = null ]  [ OBJECT_NAME = \\??\\D:\\Holden ]  [ UNC_NAME = \\\\*\\Holden ]  [ FILE_NAME = Holden ]  [ FILE_LOCATION = \\??\\D:\\ ]  [ LOGON_ID = 0x7f7c8906c ]  [ DOMAIN = acme.com ]  [ ACCESSES = ReadData (or ListDirectory) ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ TRANSACTION_ID = null ]  [ ACCESS_MASK = 1 ]  [ USERNAME = SHoward ]  [ RECORD_NUMBER = 4221394974 ]  [ USER_SID = S-1-5-21-1725571127-999974082-2044928816-19496 ]  [ ACCESS_TYPE = 1 ]  [ ACCESS_TYPE_TEXT = File/Folder Read ]  [ FORMAT_MESSAGE = User 'SHoward' Read file/folder '\\??\\D:\\Holden'. ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = Cliff Howard ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = CN=Howard\\, Cliff,OU=Dothan Desktop Users,OU=Region-Gulf Coast Desktop Users,OU=MDS-ATL Desktop User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ USER_OU_GUID = {DD158112-BACME-4B19-BB9D-672434AACF48} ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = Folder ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ NEW_PRIVILEGES_USED = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}