WitFoo-Artifact ::: tags=[mail=umbrella@uwumbrella.org,surname=Mailbox,jobTitle=UMBRELLA Mailbox,givenName=UMBRELLA,displayName=UMBRELLA Mailbox] ::: program=microsoft_graph ::: messageType=asset_inventory ::: streamName=Microsoft Graph Asset Inventory ::: userName=johndoe ::: message={"businessPhones":[],"displayName":"UMBRELLA Mailbox","givenName":"UMBRELLA","id":"63cbf594-369e-4a1a-81ca-4f049315fccb","jobTitle":"UMBRELLA Mailbox","mail":"umbrella@uwumbrella.org","mobilePhone":null,"officeLocation":null,"preferredLanguage":null,"surname":"Mailbox","userPrincipalName":"johndoe"}
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: microsoft_graph
senderHost: WitFoo-Streamer2.uwca.org
sensitivity: normal
sourceInfo: unknown
streamName: Microsoft Graph Asset Inventory
tags: ['mail=aaa@uwaaa.org', 'Microsoft Graph Asset Inventory', 'jobTitle=AAA Mailbox', 'surname=Mailbox', 'displayName=AAA Mailbox', 'givenName=AAA', 'asset_inventory']
userName: johndoe