WitFoo-Artifact ::: message={"actor":{"alternateId":"nighthawk","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxd5VZMxD0R-2O_dEfoBFq0Q","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":34.0544,"lon":-118.2441},"postalCode":"90060","state":"California"},"id":null,"ipAddress":"72.129.118.72","userAgent":{"browser":"IE11","os":"Windows 8","rawUserAgent":"Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs05a.auw2-ok14.internal//1707493987576//07c4dd2003ef2219746cf7d5ab9ac469:dd209160-e0c7-4a12-8821-5013b6deb9fa:","agentid":"a532lo6a4sAZS1Lht697","authnRequestId":"a16ceea027a096c6730e73d1cbb78d6d","delauthtimeout":"4000","delauthtimespentatagent":"31","delauthtimespentatdomaincontroller":"31","delauthtimetotal":"129","deviceFingerprint":"b0577515316ff08d7d102031ef562336","dtHash":"cd399b4dd01e7432eca3fed8a1ad18437be7b7e602d60efcd101ad46b6aa6cff","errorCode":"1326","requestId":"07c4dd2003ef2219746cf7d5ab9ac469","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T15:53:03.706Z","request":{"ipChain":[{"geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":34.0544,"lon":-118.2441},"postalCode":"90060","state":"California"},"ip":"72.129.118.72","source":null,"version":"V4"}]},"securityContext":{"asNumber":14593,"asOrg":"spacex services  inc.","domain":"starlinkisp.net","isProxy":false,"isp":"space exploration technologies corporation"},"severity":"ERROR","target":[{"alternateId":"adorudian@wayne.bank","detailEntry":null,"displayName":"Alex Dorudian","id":"0ua16z1jyxbaEARh9697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"07c4dd2003ef2219746cf7d5ab9ac469","type":"WEB"},"uuid":"4f0dd405-c763-11ee-841f-d10e07c0cb55","version":"0"} ::: messageType=auth_failure ::: action=FAILURE ::: streamName=Okta ::: userName=nighthawk ::: clientIP=72.129.118.72 ::: severityCode=2 ::: severityLabel=ERROR ::: program=okta
Product: Okta
Vendor: Okta