WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T04:33:31.893Z","agent":{"ephemeral_id":"aa96b357-d517-4faf-8466-4a84e56f29d7","id":"c5c7734b-f1c1-4011-84fa-15db81eba6a8","name":"NORDC-SS1-APID","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-27T04:33:33.436Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-SS1-APID.stark.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x0000000000001510\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{1cce652a-f165-458c-9e83-b507082fe6bc}\n Shadow ID:\t\t\t{305ccb95-23cf-42f4-b1a8-04ed25df2cba}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Mstarkine:\t\tNORDC-SS1-APID.stark.com\n Original Volume:\t\t\t\\\\?\\Volume{e0dda9db-0000-0000-0000-500600000000}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy695","organization":"stark","senderHost":"10.20.30.114","sensitivity":"normal","winlog":{"activity_id":"{c6f4cffb-f817-4217-a9ac-04ec90699a34}","api":"wineventlog","channel":"Security","computer_name":"NORDC-SS1-APID.stark.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy695","param2":"NT AUTHORITY\\SYSTEM","param3":"0x0000000000001510","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{1cce652a-f165-458c-9e83-b507082fe6bc}","param6":"{305ccb95-23cf-42f4-b1a8-04ed25df2cba}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-SS1-APID.stark.com","param9":"\\\\?\\Volume{e0dda9db-0000-0000-0000-500600000000}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","process":{"pid":3060,"thread":{"id":17844}},"provider_name":"VSSAudit","record_id":900733,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
This is a syslog message from a product called vssaudit by vssaudit. The following fields were extracted from the message:
fieldExtractorName: winlogbeat
messageType: 8222
senderHost: 10.20.30.114
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: vssaudit
tags: ['v8', 'eventId:8222', 'vssaudit', '8222']
vendorCode: 900733