<110>2024-07-26T09:02:06.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = LogonReports ]  [ REPORT_PROFILE = All Users Logon ]  [ USERNAME = host ]  [ CLIENT_IP_ADDRESS = 127.0.0.1 ]  [ CLIENT_HOST_NAME = NORDC-DC-01.wayne.com ]  [ TIME_GENERATED = 1721998926 ]  [ RECORD_NUMBER = 6067926367 ]  [ EVENT_TYPE = 16 ]  [ EVENT_TYPE_TEXT = Failure ]  [ DOMAIN = wayne.com ]  [ SOURCE = NORDC-DC-01.wayne.com ]  [ LOGON_SERVICE = krbtgt/WAYNE.COM ]  [ USER_SID = S-1-0-0 ]  [ ERROR_CODE = 0x6 ]  [ ERROR_CODE_TEXT = Bad user name ]  [ EVENT_NUMBER = 4768 ]  [ REMARKS = A Kerberos authentication ticket (TGT) was requested. ]  [ PRE_AUTHENTICATION_TYPE = - ]  [ TRANSITED_SERVICES = null ]  [ TICKET_OPTIONS = 0x40810010 ]  [ TICKET_ENCRYPTION_TYPE = 0xffffffff ]  [ CLIENT_PORT = 0 ]  [ CERTIFICATE_THUMBPRINT = null ]  [ CERTIFICATE_SERIAL_NUMBER = null ]  [ CERTIFICATE_ISSUER_NAME = null ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = null ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = null ]  [ USER_OU_GUID = null ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ CLIENT_HOST_DOMAIN_NAME = WAYNE.COM ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = A Kerberos authentication ticket (TGT) was requested for host from NORDC-DC-01.wayne.com. Status : Failure. . Error : Bad user name ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-26T09:02:06.000-04:00",
    "message": "<110>2024-07-26T09:02:06.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = LogonReports ]  [ REPORT_PROFILE = All Users Logon ]  [ USERNAME = host ]  [ CLIENT_IP_ADDRESS = 127.0.0.1 ]  [ CLIENT_HOST_NAME = NORDC-DC-01.wayne.com ]  [ TIME_GENERATED = 1721998926 ]  [ RECORD_NUMBER = 6067926367 ]  [ EVENT_TYPE = 16 ]  [ EVENT_TYPE_TEXT = Failure ]  [ DOMAIN = wayne.com ]  [ SOURCE = NORDC-DC-01.wayne.com ]  [ LOGON_SERVICE = krbtgt/WAYNE.COM ]  [ USER_SID = S-1-0-0 ]  [ ERROR_CODE = 0x6 ]  [ ERROR_CODE_TEXT = Bad user name ]  [ EVENT_NUMBER = 4768 ]  [ REMARKS = A Kerberos authentication ticket (TGT) was requested. ]  [ PRE_AUTHENTICATION_TYPE = - ]  [ TRANSITED_SERVICES = null ]  [ TICKET_OPTIONS = 0x40810010 ]  [ TICKET_ENCRYPTION_TYPE = 0xffffffff ]  [ CLIENT_PORT = 0 ]  [ CERTIFICATE_THUMBPRINT = null ]  [ CERTIFICATE_SERIAL_NUMBER = null ]  [ CERTIFICATE_ISSUER_NAME = null ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = null ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = null ]  [ USER_OU_GUID = null ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ CLIENT_HOST_DOMAIN_NAME = WAYNE.COM ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = A Kerberos authentication ticket (TGT) was requested for host from NORDC-DC-01.wayne.com. Status : Failure. . Error : Bad user name ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}