WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2023-08-15T20:38:19.605Z","agent":{"ephemeral_id":"58f5da08-4b66-497e-b13a-b9936e61eb18","id":"106936a2-47e9-46b2-81b6-e23a3752c9b3","name":"EventSentry1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Syslog","code":"500","created":"2023-08-15T20:38:20.313Z","kind":"event","provider":"EventSentry Network Services"},"host":{"name":"EventSentry1.oscorp.org"},"log":{"level":"warning"},"message":"syslog@10.0.0.1[local4.warning]: Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:172.62.215.211 dst outside:79.121.246.127 (type 3, code 3) by access-group \"dmz_access_in\" [0x0, 0x0]","organization":"oscorp","senderHost":"EventSentry1.oscorp.org","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"EventSentry1.oscorp.org","event_data":{"param1":"10.0.0.1","param2":"local4","param3":"warning","param4":"Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:172.62.215.211 dst outside:79.121.246.127 (type 3, code 3) by access-group \"dmz_access_in\" [0x0, 0x0]"},"event_id":"500","keywords":["Classic"],"opcode":"Info","provider_name":"EventSentry Network Services","record_id":1951580,"task":"Syslog"}}
{
    "action": "block",
    "facilitycode": 1,
    "facilitylabel": "user-level",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2023-08-15T20:38:19.605Z\",\"agent\":{\"ephemeral_id\":\"58f5da08-4b66-497e-b13a-b9936e61eb18\",\"id\":\"106936a2-47e9-46b2-81b6-e23a3752c9b3\",\"name\":\"EventSentry1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Syslog\",\"code\":\"500\",\"created\":\"2023-08-15T20:38:20.313Z\",\"kind\":\"event\",\"provider\":\"EventSentry Network Services\"},\"host\":{\"name\":\"EventSentry1.oscorp.org\"},\"log\":{\"level\":\"warning\"},\"message\":\"syslog@10.0.0.1[local4.warning]: Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:172.62.215.211 dst outside:79.121.246.127 (type 3, code 3) by access-group \\\"dmz_access_in\\\" [0x0, 0x0]\",\"organization\":\"oscorp\",\"senderHost\":\"EventSentry1.oscorp.org\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"EventSentry1.oscorp.org\",\"event_data\":{\"param1\":\"10.0.0.1\",\"param2\":\"local4\",\"param3\":\"warning\",\"param4\":\"Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:172.62.215.211 dst outside:79.121.246.127 (type 3, code 3) by access-group \\\"dmz_access_in\\\" [0x0, 0x0]\"},\"event_id\":\"500\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_name\":\"EventSentry Network Services\",\"record_id\":1951580,\"task\":\"Syslog\"}}",
    "messagetype": "firewall_action",
    "priority": 13,
    "protocol": 1,
    "senderhost": "EventSentry1.uwca.org",
    "sensitivity": "normal",
    "severitycode": 5,
    "severitylabel": "notice",
    "sourceinfo": "unknown",
    "tags": [
        "cisco_asa_deny",
        "deny",
        "cisco_asa",
        "firewall_action"
    ],
    "vendorcode": "ASA-4-106023",
    "streamName": "cisco_asa",
    "clientIP": "172.62.215.211",
    "serverIP": "79.121.246.127"
}