WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T18:08:24.191Z","agent":{"ephemeral_id":"c7c916ce-56ef-4255-9f46-4ca9ce1b5050","id":"9c19b391-75f6-44e4-a324-d6fa6da22ca7","name":"NORDC-DC-04","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-26T18:08:25.236Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-DC-04.stark.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x0000000000003020\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{36d8ef1b-2739-41b3-867f-686519a120e9}\n Shadow ID:\t\t\t{78b7c849-3942-4916-8dbe-982916f877a5}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Mstarkine:\t\tNORDC-DC-04.stark.com\n Original Volume:\t\t\t\\\\?\\Volume{8407c4fe-0000-0000-0000-602200000000}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy304","organization":"stark","senderHost":"NORDC-DC-04.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"NORDC-DC-04.stark.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy304","param2":"NT AUTHORITY\\SYSTEM","param3":"0x0000000000003020","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{36d8ef1b-2739-41b3-867f-686519a120e9}","param6":"{78b7c849-3942-4916-8dbe-982916f877a5}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-DC-04.stark.com","param9":"\\\\?\\Volume{8407c4fe-0000-0000-0000-602200000000}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","provider_name":"VSSAudit","record_id":514332084,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
Product: vssaudit
Vendor: vssaudit