WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T19:56:17.507Z","agent":{"ephemeral_id":"964d0404-9b18-4f2b-a3fe-7db4be557fbf","id":"8809f950-580f-4473-8f56-fd5ca481b748","name":"Proteus","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-26T19:56:18.634Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"Proteus.acme.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x0000000000000520\n \n Shadow Set ID:\t\t\t{2279f003-5c68-471f-88cd-5558c5655852}\n Shadow ID:\t\t\t{84ab2496-6092-4489-8a84-62d9bfde9a05}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Macmeine:\t\tProteus.acme.com\n Original Volume:\t\t\t\\\\?\\Volume{cfb252d7-8144-4dcd-931e-ecb325ed0417}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1671","organization":"acme","senderHost":"Proteus.acme.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Proteus.acme.com","event_data":{"param1":"S-1-5-18","param2":"NT AUTHORITY\\SYSTEM","param3":"0x0000000000000520","param4":"{2279f003-5c68-471f-88cd-5558c5655852}","param5":"{84ab2496-6092-4489-8a84-62d9bfde9a05}","param6":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param7":"Proteus.acme.com","param8":"\\\\?\\Volume{cfb252d7-8144-4dcd-931e-ecb325ed0417}\\","param9":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1671"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","provider_name":"VSSAudit","record_id":8599915345,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T19:56:17.507Z\",\"agent\":{\"ephemeral_id\":\"964d0404-9b18-4f2b-a3fe-7db4be557fbf\",\"id\":\"8809f950-580f-4473-8f56-fd5ca481b748\",\"name\":\"Proteus\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"8222\",\"created\":\"2024-07-26T19:56:18.634Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"VSSAudit\"},\"host\":{\"name\":\"Proteus.acme.com\"},\"log\":{\"level\":\"information\"},\"message\":\"Shadow copy has been created.\\n \\n User SID:\\t\\t\\tS-1-5-18\\n User name:\\t\\t\\tNT AUTHORITY\\\\SYSTEM\\n Process ID:\\t\\t\\t0x0000000000000520\\n \\n Shadow Set ID:\\t\\t\\t{2279f003-5c68-471f-88cd-5558c5655852}\\n Shadow ID:\\t\\t\\t{84ab2496-6092-4489-8a84-62d9bfde9a05}\\n Provider ID:\\t\\t\\t{b5946137-7b9f-4925-af80-51abd60b20d5}\\n Original Macmeine:\\t\\tProteus.acme.com\\n Original Volume:\\t\\t\\t\\\\\\\\?\\\\Volume{cfb252d7-8144-4dcd-931e-ecb325ed0417}\\\\\\n Shadow device name:\\t\\t\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1671\",\"organization\":\"acme\",\"senderHost\":\"Proteus.acme.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Proteus.acme.com\",\"event_data\":{\"param1\":\"S-1-5-18\",\"param2\":\"NT AUTHORITY\\\\SYSTEM\",\"param3\":\"0x0000000000000520\",\"param4\":\"{2279f003-5c68-471f-88cd-5558c5655852}\",\"param5\":\"{84ab2496-6092-4489-8a84-62d9bfde9a05}\",\"param6\":\"{b5946137-7b9f-4925-af80-51abd60b20d5}\",\"param7\":\"Proteus.acme.com\",\"param8\":\"\\\\\\\\?\\\\Volume{cfb252d7-8144-4dcd-931e-ecb325ed0417}\\\\\",\"param9\":\"\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1671\"},\"event_id\":\"8222\",\"keywords\":[\"Audit Success\",\"Classic\"],\"opcode\":\"Info\",\"provider_name\":\"VSSAudit\",\"record_id\":8599915345,\"user\":{\"domain\":\"NT AUTHORITY\",\"identifier\":\"S-1-5-18\",\"name\":\"SYSTEM\",\"type\":\"User\"}}}",
    "messageType": "8222",
    "senderHost": "Proteus.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "vssaudit",
    "tags": [
        "v8",
        "eventId:8222",
        "vssaudit",
        "8222"
    ],
    "vendorCode": "8599915345"
}