WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.stark.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 1d 1a 78 66 f3 b8 ff de 9c 5f 88 f3 43 78 ca b5 5a e4 72 ee is about to expire or already expired.","organization":"stark","senderHost":"nordc-app-fs01.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.stark.com","event_data":{"Context":"local system","ObjId":"1d 1a 78 66 f3 b8 ff de 9c 5f 88 f3 43 78 ca b5 5a e4 72 ee"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284645,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:20:09.001Z\",\"agent\":{\"ephemeral_id\":\"9e8b3684-f98e-4660-a5f0-b9055e0435e9\",\"id\":\"60a0a7eb-8adf-44b2-8571-636680a0f5cd\",\"name\":\"NORDC-APP-FS01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T13:20:09.148Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-FS01.stark.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint 1d 1a 78 66 f3 b8 ff de 9c 5f 88 f3 43 78 ca b5 5a e4 72 ee is about to expire or already expired.\",\"organization\":\"stark\",\"senderHost\":\"nordc-app-fs01.stark.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-FS01.stark.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"1d 1a 78 66 f3 b8 ff de 9c 5f 88 f3 43 78 ca b5 5a e4 72 ee\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":1284645,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "nordc-app-fs01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "1284645"
}