<110>2024-07-27T00:00:04.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = LogonReports ]  [ REPORT_PROFILE = All Users Logon ]  [ USERNAME = orion ]  [ CLIENT_IP_ADDRESS = 192.168.10.233 ]  [ CLIENT_HOST_NAME = Nordc-app-Dell.acme.com ]  [ TIME_GENERATED = 1722052804 ]  [ RECORD_NUMBER = 515513120 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ DOMAIN = acme.com ]  [ SOURCE = nordc-dc-04.acme.com ]  [ LOGON_SERVICE = krbtgt ]  [ USER_SID = S-1-5-21-1725571127-999974082-2044928816-27739 ]  [ ERROR_CODE = 0x0 ]  [ ERROR_CODE_TEXT = - ]  [ EVENT_NUMBER = 4768 ]  [ REMARKS = A Kerberos authentication ticket (TGT) was requested. ]  [ PRE_AUTHENTICATION_TYPE = 2 ]  [ TRANSITED_SERVICES = null ]  [ TICKET_OPTIONS = 0x40810010 ]  [ TICKET_ENCRYPTION_TYPE = 0x12 ]  [ CLIENT_PORT = 54126 ]  [ CERTIFICATE_THUMBPRINT = null ]  [ CERTIFICATE_SERIAL_NUMBER = null ]  [ CERTIFICATE_ISSUER_NAME = null ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = orion Zabbix ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = CN=Orion-Zabbix,CN=Managed Service Accounts,DC=acme,DC=com ]  [ USER_OU_GUID = {5E2C5CB4-DC53-4D75-8D55-9EF3B54DFE53} ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ CLIENT_HOST_DOMAIN_NAME = mds-atl ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = A Kerberos authentication ticket (TGT) was requested for orion from Nordc-app-Dell.acme.com. Status : Success. ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-27T00:00:04.000-04:00",
    "message": "<110>2024-07-27T00:00:04.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = LogonReports ]  [ REPORT_PROFILE = All Users Logon ]  [ USERNAME = orion ]  [ CLIENT_IP_ADDRESS = 192.168.10.233 ]  [ CLIENT_HOST_NAME = Nordc-app-Dell.acme.com ]  [ TIME_GENERATED = 1722052804 ]  [ RECORD_NUMBER = 515513120 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ DOMAIN = acme.com ]  [ SOURCE = nordc-dc-04.acme.com ]  [ LOGON_SERVICE = krbtgt ]  [ USER_SID = S-1-5-21-1725571127-999974082-2044928816-27739 ]  [ ERROR_CODE = 0x0 ]  [ ERROR_CODE_TEXT = - ]  [ EVENT_NUMBER = 4768 ]  [ REMARKS = A Kerberos authentication ticket (TGT) was requested. ]  [ PRE_AUTHENTICATION_TYPE = 2 ]  [ TRANSITED_SERVICES = null ]  [ TICKET_OPTIONS = 0x40810010 ]  [ TICKET_ENCRYPTION_TYPE = 0x12 ]  [ CLIENT_PORT = 54126 ]  [ CERTIFICATE_THUMBPRINT = null ]  [ CERTIFICATE_SERIAL_NUMBER = null ]  [ CERTIFICATE_ISSUER_NAME = null ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = orion Zabbix ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = CN=Orion-Zabbix,CN=Managed Service Accounts,DC=acme,DC=com ]  [ USER_OU_GUID = {5E2C5CB4-DC53-4D75-8D55-9EF3B54DFE53} ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ CLIENT_HOST_DOMAIN_NAME = mds-atl ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = A Kerberos authentication ticket (TGT) was requested for orion from Nordc-app-Dell.acme.com. Status : Success. ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}