<110>2024-07-26T21:27:44.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ADAPAlerts ]  [ UNIQUE_ID = 227644 ]  [ ALERT_PROFILE = Unusual Activity -Logon Time (Based on User)  ]  [ REPORT_PROFILE = AD Analytics ]  [ SEVERITY = 2 ]  [ TIME_GENERATED = 1722043664 ]  [ FORMAT_MESSAGE = Logon activity was done by eyanna.tehrani within 9-10 PM which deviates from user's normal Logon activity hours:6 AM-6 PM. Anomaly category:Unusual Activity -Logon Time (Based on User)  ]  [ SOURCE = User Behaviour Analytics ]  [ DOMAIN = oscorp.com ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-26T21:27:44.000-04:00",
    "message": "<110>2024-07-26T21:27:44.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ADAPAlerts ]  [ UNIQUE_ID = 227644 ]  [ ALERT_PROFILE = Unusual Activity -Logon Time (Based on User)  ]  [ REPORT_PROFILE = AD Analytics ]  [ SEVERITY = 2 ]  [ TIME_GENERATED = 1722043664 ]  [ FORMAT_MESSAGE = Logon activity was done by eyanna.tehrani within 9-10 PM which deviates from user's normal Logon activity hours:6 AM-6 PM. Anomaly category:Unusual Activity -Logon Time (Based on User)  ]  [ SOURCE = User Behaviour Analytics ]  [ DOMAIN = oscorp.com ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}