WitFoo-Artifact ::: tags=["description=User login to Okta","userDisplay=Andrew Yun | Corporate Admininstration","reason=WitFoo.Switch(FAILURE)"] ::: action=FAILURE ::: message={"user":{"id":"00u6409l1ibSud4np697","status":"ACTIVE","created":"2023-06-21T21:57:30.000Z","activated":"2023-06-21T21:57:31.000Z","statusChanged":"2023-06-21T21:57:31.000Z","lastLogin":"2023-06-26T18:35:19.000Z","lastUpdated":"2023-06-21T21:57:31.000Z","passwordChanged":null,"type":{"id":"oty16ygr7f2XinpEr697"},"profile":{"firstName":"Andrew","lastName":"Yun","primaryPhone":"(424) 348-2182","immutableID":"Iwcz27SlcUWw+LWmzlUfDg==","mobilePhone":null,"displayName":"Andrew Yun","countryCode":"US","secondEmail":null,"title":"Director of Product Strategy & Innovation","department":"Corporate Admininstration","login":"charlie","email":"charlie"},"credentials":{"provider":{"type":"ACTIVE_DIRECTORY","name":"SDPB.LOCAL"}},"_links":{"suspend":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/lifecycle/suspend","method":"POST"},"schema":{"href":"https://acme.okta.com/api/v1/meta/schemas/user/osc16ygr7f2XinpEr697"},"resetPassword":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/lifecycle/reset_password","method":"POST"},"forgotPassword":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/credentials/forgot_password","method":"POST"},"expirePassword":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/lifecycle/expire_password","method":"POST"},"changeRecoveryQuestion":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/credentials/change_recovery_question","method":"POST"},"self":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697"},"resetFactors":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/lifecycle/reset_factors","method":"POST"},"type":{"href":"https://acme.okta.com/api/v1/meta/types/user/oty16ygr7f2XinpEr697"},"changePassword":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/credentials/change_password","method":"POST"},"deactivate":{"href":"https://acme.okta.com/api/v1/users/00u6409l1ibSud4np697/lifecycle/deactivate","method":"POST"}}},"event":{"actor":{"id":"00u6409l1ibSud4np697","type":"User","alternateId":"charlie","displayName":"Andrew Yun","detailEntry":null},"client":{"userAgent":{"rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36","os":"Windows 10","browser":"CHROME"},"zone":"null","device":"Computer","id":null,"ipAddress":"114.131.168.253","geographicalContext":{"city":"San Diego","state":"California","country":"United States","postalCode":"92103","geolocation":{"lat":32.7449,"lon":-117.165}}},"device":null,"authenticationContext":{"authenticationProvider":null,"credentialProvider":null,"credentialType":null,"issuer":null,"interface":null,"authenticationStep":0,"externalSessionId":"idxKdZhsIDOQA6nsnlVzUD55A"},"displayMessage":"User login to Okta","eventType":"user.session.start","outcome":{"result":"FAILURE","reason":"INVALID_CREDENTIALS"},"published":"2023-06-26T18:28:42.091Z","securityContext":{"asNumber":22773,"asOrg":"cox communications inc.","isp":"cox communications inc.","domain":"cox.net","isProxy":false},"severity":"WARN","debugContext":{"debugData":{"authnRequestId":"ZJnY1AinXtKsKFExrQTHcQACME7w","deviceFingerprint":"3e2677fc15a40ac95e05989ebd7256f7","requestId":"ZJnY2DaXH-Fn6ZFvOONojQAADa0","dtHash":"3243ea6618453af3caeb9e4cca0b803812a8316cb7f96c6b3ad613de66e9ce05","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?","logOnlySecurityData":"{\"risk\":{\"reasons\":\"Anomalous Device\",\"level\":\"HIGH\"},\"behaviors\":{\"New Geo-Location\":\"NEGATIVE\",\"New Device\":\"POSITIVE\",\"New IP\":\"NEGATIVE\",\"New State\":\"NEGATIVE\",\"New Country\":\"NEGATIVE\",\"Velocity\":\"NEGATIVE\",\"New City\":\"NEGATIVE\"}}"}},"legacyEventType":"core.user_auth.login_failed","transaction":{"type":"WEB","id":"ZJnY2DaXH-Fn6ZFvOONojQAADa0","detail":{}},"uuid":"46fb4bb4-144f-11ee-87a2-3d40a26a4256","version":"0","request":{"ipChain":[{"ip":"114.131.168.253","geographicalContext":{"city":"San Diego","state":"California","country":"United States","postalCode":"92103","geolocation":{"lat":32.7449,"lon":-117.165}},"version":"V4","source":null}]},"target":[{"id":"laer9c2j8iOREDi04696","type":"AuthenticatorEnrollment","alternateId":"unknown","displayName":"Password","detailEntry":null},{"id":"0oa2kbwyr3wK2PkBt697","type":"AppInstance","alternateId":"Microsoft 365 Portal","displayName":"Microsoft 365 Portal","detailEntry":null}]}} ::: program=CHROME ::: clientIP=114.131.168.253 ::: userName=charlie ::: geoRegion=United States ::: created_at=2023-06-26T18:28:42.091Z ::: streamName=Okta ::: vendorCode=user.session.start ::: messageType=auth_failure ::: pipelineName=Okta ::: severityCode=3 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Okta by Okta. The following fields were extracted from the message:
action: FAILURE
georegion: United States
messagetype: auth_failure
productids: [6]
program: CHROME
senderhost: kafka.precinct
sensitivity: normal
severitycode: 3
severitylabel: error
sourceinfo: unknown
tags: ['reason=WitFoo.Switch(FAILURE)', 'Okta', 'userDisplay=Andrew Yun | Corporate Admininstration', 'description=User login to Okta', 'auth_failure']
vendorcode: user.session.start
streamName: Okta
clientIP: 114.131.168.253
userName: charlie