<189>38304: FULREP03: Jul 26 12:33:14.750: %DMI-5-AUTH_PASSED: Switch 6 R0/0: dmiauthd: User 'sentinel' authenticated successfully from 10.0.1.170:52214  for netconf over ssh. External groups: PRIV15
{
    "fieldExtractorName": "cisco_os",
    "message": "<189>38304: FULREP03: Jul 26 12:33:14.750: %DMI-5-AUTH_PASSED: Switch 6 R0/0: dmiauthd: User 'sentinel' authenticated successfully from 10.0.1.170:52214  for netconf over ssh. External groups: PRIV15",
    "messageType": "management_message",
    "ruleCategory": "dmi",
    "ruleName": "auth_passed",
    "senderHost": "10.3.81.252",
    "sensitivity": "normal",
    "severityCode": 5,
    "severityLabel": "notice",
    "sourceInfo": "unknown",
    "streamName": "cisco_os",
    "tags": [
        "cisco_os",
        "management_message"
    ]
}