WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=140.240.62.197 ::: message={"access_device":{"epkey":"EP0Q6BEUW7115D09QPAY","hostname":null,"ip":"140.240.62.197","location":{"city":"Suwanee","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"140.240.62.197","key":"DPSIKHUSM0JIU4Y2CSCH","location":{"city":"Suwanee","country":"United States","state":"Georgia"},"name":"678-232-3375"},"email":"johndoe@starkelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-07-25T19:21:52.762783+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1690312912,"trusted_endpoint_status":"unknown","txid":"6bd44af8-7971-43b4-9943-bc9fc747c666","user":{"groups":[],"key":"DU46KG199M41WHFC7M4K","name":"johndoe"}} ::: clientIP=140.240.62.197 ::: userName=johndoe ::: created_at=1690312912 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1690312912 ::: clientHostname=678-232-3375 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 678-232-3375
localip: 75.63.121.145
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1690312912
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 140.240.62.197
userName: johndoe