WitFoo-Artifact ::: message={"actor":{"alternateId":"bob","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxDOZ3MPkUSKO9L5A4PNWfvg","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.8003,"lon":-117.2438},"postalCode":"92109","state":"California"},"id":null,"ipAddress":"140.123.143.70","userAgent":{"browser":"CHROME","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs17a.auw2-ok14.internal//1707493923432//43cafbcb3d0e3013c1cc95ba3fc94f96:ec143e95-c742-4d6a-8a54-237a09a340c5:","agentid":"a539kiyvwggVTfYyD697","authnRequestId":"e2f918081470c42b3d3a75c43cebca72","delauthtimeout":"4000","delauthtimespentatagent":"172","delauthtimespentatdomaincontroller":"172","delauthtimetotal":"461","deviceFingerprint":"f7a6c7c4b916021a7f757b65abce2480","dtHash":"22a29f1da539ffdf3335a44f6dec6b49db17a6517d984de05edb8996bfebfab4","errorCode":"1326","requestId":"43cafbcb3d0e3013c1cc95ba3fc94f96","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T15:51:59.893Z","request":{"ipChain":[{"geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.8003,"lon":-117.2438},"postalCode":"92109","state":"California"},"ip":"140.123.143.70","source":null,"version":"V4"}]},"securityContext":{"asNumber":3356,"asOrg":"level 3 parent  llc","domain":"level3.net","isProxy":false,"isp":"level 3 parent  llc"},"severity":"ERROR","target":[{"alternateId":"Mcampion@acme.bank","detailEntry":null,"displayName":"Mary Campion","id":"0ua16z1jzrfvgvAFL697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"43cafbcb3d0e3013c1cc95ba3fc94f96","type":"WEB"},"uuid":"2904bd44-c763-11ee-8200-89111b4472be","version":"0"} ::: clientIP=140.123.143.70 ::: program=okta ::: severityCode=2 ::: severityLabel=ERROR ::: streamName=Okta ::: userName=bob ::: action=FAILURE ::: messageType=auth_failure
{
    "action": "FAILURE",
    "message": "WitFoo-Artifact ::: message={\"actor\":{\"alternateId\":\"bob\",\"detailEntry\":null,\"displayName\":\"Okta System\",\"id\":\"spr16ygr5qFPw1bhs697\",\"type\":\"SystemPrincipal\"},\"authenticationContext\":{\"authenticationProvider\":\"ACTIVE_DIRECTORY\",\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":\"PASSWORD\",\"externalSessionId\":\"idxDOZ3MPkUSKO9L5A4PNWfvg\",\"interface\":\"AD APP Instance\",\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"San Diego\",\"country\":\"United States\",\"geolocation\":{\"lat\":32.8003,\"lon\":-117.2438},\"postalCode\":\"92109\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"140.123.143.70\",\"userAgent\":{\"browser\":\"CHROME\",\"os\":\"Windows 10\",\"rawUserAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"actionid\":\"rpc::app.active_directory.agent.reply.ok14-majorecs17a.auw2-ok14.internal//1707493923432//43cafbcb3d0e3013c1cc95ba3fc94f96:ec143e95-c742-4d6a-8a54-237a09a340c5:\",\"agentid\":\"a539kiyvwggVTfYyD697\",\"authnRequestId\":\"e2f918081470c42b3d3a75c43cebca72\",\"delauthtimeout\":\"4000\",\"delauthtimespentatagent\":\"172\",\"delauthtimespentatdomaincontroller\":\"172\",\"delauthtimetotal\":\"461\",\"deviceFingerprint\":\"f7a6c7c4b916021a7f757b65abce2480\",\"dtHash\":\"22a29f1da539ffdf3335a44f6dec6b49db17a6517d984de05edb8996bfebfab4\",\"errorCode\":\"1326\",\"requestId\":\"43cafbcb3d0e3013c1cc95ba3fc94f96\",\"requestUri\":\"/idp/idx/identify\",\"threatSuspected\":\"false\",\"url\":\"/idp/idx/identify?\"}},\"device\":null,\"displayMessage\":\"Authenticate user with AD agent\",\"eventType\":\"user.authentication.auth_via_AD_agent\",\"legacyEventType\":\"app.ad.login.bad_password\",\"outcome\":{\"reason\":\"Authentication failed: bad username or password\",\"result\":\"FAILURE\"},\"published\":\"2024-02-09T15:51:59.893Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"San Diego\",\"country\":\"United States\",\"geolocation\":{\"lat\":32.8003,\"lon\":-117.2438},\"postalCode\":\"92109\",\"state\":\"California\"},\"ip\":\"140.123.143.70\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":3356,\"asOrg\":\"level 3 parent  llc\",\"domain\":\"level3.net\",\"isProxy\":false,\"isp\":\"level 3 parent  llc\"},\"severity\":\"ERROR\",\"target\":[{\"alternateId\":\"Mcampion@acme.bank\",\"detailEntry\":null,\"displayName\":\"Mary Campion\",\"id\":\"0ua16z1jzrfvgvAFL697\",\"type\":\"AppUser\"},{\"alternateId\":\"SDPB.LOCAL\",\"detailEntry\":null,\"displayName\":\"Active Directory\",\"id\":\"0oa16yxhp6iUzuI2b697\",\"type\":\"AppInstance\"}],\"transaction\":{\"detail\":{},\"id\":\"43cafbcb3d0e3013c1cc95ba3fc94f96\",\"type\":\"WEB\"},\"uuid\":\"2904bd44-c763-11ee-8200-89111b4472be\",\"version\":\"0\"} ::: clientIP=140.123.143.70 ::: program=okta ::: severityCode=2 ::: severityLabel=ERROR ::: streamName=Okta ::: userName=bob ::: action=FAILURE ::: messageType=auth_failure",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "program": "okta",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "tags": [
        "Okta",
        "auth_failure"
    ],
    "streamName": "Okta",
    "clientIP": "140.123.143.70",
    "userName": "bob"
}