WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T01:32:39.180Z","agent":{"ephemeral_id":"6ac353d2-5811-4f48-be57-8a2a0c675eca","id":"aac25b4f-0ad8-4d8a-a376-dd5d77ec4ba9","name":"NORDC-SS1-WEBD1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-27T01:32:39.950Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-SS1-WEBD1.oscorp.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x00000000000021dc\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{9998a327-f87d-48c0-ba5a-1208abc42d48}\n Shadow ID:\t\t\t{949a3f5f-a497-4a9a-a91d-f47bff7c4760}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Moscorpine:\t\tNORDC-SS1-WEBD1.oscorp.com\n Original Volume:\t\t\t\\\\?\\Volume{1526e0b6-634d-413f-ae9f-d0e2348b91a0}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1730","organization":"oscorp","senderHost":"10.20.30.110","sensitivity":"normal","winlog":{"activity_id":"{0031cef0-d42f-4f02-ac03-fdba1bd57e11}","api":"wineventlog","channel":"Security","computer_name":"NORDC-SS1-WEBD1.oscorp.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1730","param2":"NT AUTHORITY\\SYSTEM","param3":"0x00000000000021dc","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{9998a327-f87d-48c0-ba5a-1208abc42d48}","param6":"{949a3f5f-a497-4a9a-a91d-f47bff7c4760}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-SS1-WEBD1.oscorp.com","param9":"\\\\?\\Volume{1526e0b6-634d-413f-ae9f-d0e2348b91a0}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","process":{"pid":748,"thread":{"id":12764}},"provider_name":"VSSAudit","record_id":971708,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
Product: vssaudit
Vendor: vssaudit