WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.stark.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1 is about to expire or already expired.","organization":"stark","senderHost":"nordc-app-fs01.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.stark.com","event_data":{"Context":"local system","ObjId":"33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284644,"task":"None"}}
This is a syslog message from a product called microsoft-windows-certificateservicesclient-autoenrollment by microsoft-windows-certificateservicesclient-autoenrollment. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 64
senderHost: nordc-app-fs01.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-certificateservicesclient-autoenrollment
tags: ['v8', 'eventId:64', 'microsoft-windows-certificateservicesclient-autoenrollment', '64']
vendorCode: 1284644