WitFoo-Artifact ::: streamName=DUO Asset Inventory ::: message={"access_device":{"browser":"DuoWinLogon","browser_version":"4.2.0","epkey":null,"flash_version":null,"hostname":"L-F46HYW3","ip":"0.0.0.0","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":"Windows","os_version":"10.0.22621.3880"},"adaptive_trust_assessments":{},"alias":"unknown","application":{"key":"DIR75ZP575GMX3E3CEZE","name":"Microsoft RDP"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T18:38:37.000000+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","result":"success","timestamp":1722019117,"trusted_endpoint_status":"unknown","txid":"53971329-844e-4326-bb22-a2e92cfd6374","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DUQZOGFX2ZSXHEOB29VX","name":"sonya.haynes"}} ::: program=cisco_duo ::: tags=[remembered_device] ::: messageType=auth_success
{
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: streamName=DUO Asset Inventory ::: message={\"access_device\":{\"browser\":\"DuoWinLogon\",\"browser_version\":\"4.2.0\",\"epkey\":null,\"flash_version\":null,\"hostname\":\"L-F46HYW3\",\"ip\":\"0.0.0.0\",\"is_encryption_enabled\":\"unknown\",\"is_firewall_enabled\":\"unknown\",\"is_password_set\":\"unknown\",\"java_version\":null,\"location\":{\"city\":null,\"country\":null,\"state\":null},\"os\":\"Windows\",\"os_version\":\"10.0.22621.3880\"},\"adaptive_trust_assessments\":{},\"alias\":\"unknown\",\"application\":{\"key\":\"DIR75ZP575GMX3E3CEZE\",\"name\":\"Microsoft RDP\"},\"auth_device\":{\"ip\":null,\"key\":null,\"location\":{\"city\":null,\"country\":null,\"state\":null},\"name\":null},\"email\":null,\"event_type\":\"authentication\",\"factor\":\"remembered_device\",\"isotimestamp\":\"2024-07-26T18:38:37.000000+00:00\",\"ood_software\":null,\"rbfs_triggered_attacks\":null,\"reason\":\"remembered_device\",\"result\":\"success\",\"timestamp\":1722019117,\"trusted_endpoint_status\":\"unknown\",\"txid\":\"53971329-844e-4326-bb22-a2e92cfd6374\",\"user\":{\"groups\":[\"DuoUsers (from AD sync \\\"AD Sync\\\")\"],\"key\":\"DUQZOGFX2ZSXHEOB29VX\",\"name\":\"sonya.haynes\"}} ::: program=cisco_duo ::: tags=[remembered_device] ::: messageType=auth_success",
    "messageType": "auth_success",
    "program": "cisco_duo",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "DUO Asset Inventory",
    "tags": [
        "remembered_device",
        "DUO Asset Inventory",
        "auth_success"
    ]
}