WitFoo-Artifact ::: clientGUID=8e03cafcab204e75a3cd2b31bdc68cc4 ::: tags=[os=Amazon Linux 2,last_seen=2024-07-10T00:47:36Z,hardware_product=t3.micro,hardware_manufacturer=Amazon EC2] ::: clientIP=118.186.1.61 ::: program=crowdstrike_falcon ::: clientHostname=NCAMGTDUO01 ::: streamName=Crowdstrike Asset Inventory ::: messageType=asset_inventory ::: message={"agent_load_flags":"0","agent_local_time":"2024-06-26T23:09:20.866Z","agent_version":"7.16.16903.0","bios_manufacturer":"Amazon EC2","bios_version":"1.0","chassis_type":"1","chassis_type_desc":"Other","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"16903","config_id_platform":"8","connection_ip":"118.186.1.61","connection_mac_address":"06-3c-f6-ae-99-17","cpu_signature":"329303","cpu_vendor":"0","default_gateway_ip":"10.248.6.1","deployment_type":"Standard","device_id":"8e03cafcab204e75a3cd2b31bdc68cc4","device_policies":{"fim":{"applied":true,"applied_date":"2024-06-12T01:21:54.325964953Z","assigned_date":"2024-06-12T01:20:43.098556718Z","policy_id":"18bc7bad59ff40e48212debaafa69be7","policy_type":"fim","settings_hash":"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6"},"global_config":{"applied":true,"applied_date":"2024-06-26T23:11:24.283425784Z","assigned_date":"2024-06-26T23:09:24.330783208Z","policy_id":"342bff7c15ef474a8eb7e6635b9fddb0","policy_type":"globalconfig","settings_hash":"739c040"},"prevention":{"applied":true,"applied_date":"2024-06-12T01:26:57.164897369Z","assigned_date":"2024-06-12T01:26:18.114898832Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"},"remote_response":{"applied":true,"applied_date":"2024-06-12T01:21:54.14275706Z","assigned_date":"2024-06-12T01:20:43.098269143Z","policy_id":"80fa74fcb9c84b90bed01c4b76a7eaa3","policy_type":"remote-response","settings_hash":"17550b92"},"sensor_update":{"applied":true,"applied_date":"2024-06-26T23:11:24.267812398Z","assigned_date":"2024-06-26T23:08:29.122998794Z","policy_id":"cf70114f29204128b689d83524396e83","policy_type":"sensor-update","settings_hash":"tagged|5;","uninstall_protection":"UNKNOWN"}},"external_ip":"52.8.6.16","filesystem_containment_status":"normal","first_seen":"2024-06-12T01:07:01Z","group_hash":"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9","groups":["8c86687045fc4af494d67259fb834ea6"],"hostname":"NCAMGTDUO01","instance_id":"i-02d83c92b3956ad5e","kernel_version":"4.14.336-257.568.amzn2.x86_64","last_seen":"2024-07-10T00:47:36Z","linux_sensor_mode":"Kernel Mode","local_ip":"118.186.1.61","mac_address":"06-3c-f6-ae-99-17","major_version":"4","meta":{"version":"2920","version_string":"18:88142009808"},"minor_version":"14","modified_timestamp":"2024-07-10T00:48:29Z","os_version":"Amazon Linux 2","platform_id":"3","platform_name":"Linux","policies":[{"applied":true,"applied_date":"2024-06-12T01:26:57.164897369Z","assigned_date":"2024-06-12T01:26:18.114898832Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"}],"product_type_desc":"Server","provision_status":"NotProvisioned","reduced_functionality_mode":"no","serial_number":"ec2eb559-9272-536f-c213-d817d3c1aa21","service_provider":"AWS_EC2_V2","service_provider_account_id":"550132162628","status":"normal","system_manufacturer":"Amazon EC2","system_product_name":"t3.micro","tags":[],"zone_group":"us-west-1a"}
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clientGUID: 8e03cafcab204e75a3cd2b31bdc68cc4
clientHostname: NCAMGTDUO01
clientIP: 118.186.1.61
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: crowdstrike_falcon
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: Crowdstrike Asset Inventory
tags: ['hardware_manufacturer=Amazon EC2', 'Crowdstrike Asset Inventory', 'hardware_product=t3.micro', 'os=Amazon Linux 2', 'last_seen=2024-07-10T00:47:36Z', 'asset_inventory']