WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=43.174.166.154 ::: message={"access_device":{"epkey":"EPYQH6MVB4MBY61TJJ61","hostname":null,"ip":"43.174.166.154","location":{"city":"Cumming","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"43.174.166.154","key":"DP0W9R0H7R0WJ4GY2HK8","location":{"city":"Cumming","country":"United States","state":"Georgia"},"name":"phone2 (314-537-1336)"},"email":"jbetro@umbrellaelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-07-15T23:20:52.848939+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1689463252,"trusted_endpoint_status":"unknown","txid":"775732fa-0784-41d7-umbrella5-27ceabdacac0","user":{"groups":[],"key":"DUCOEHG5PIQG8MF7JIQ7","name":"johndoe"}} ::: clientIP=43.174.166.154 ::: userName=johndoe ::: created_at=1689463252 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1689463252 ::: clientHostname=phone2 (314-537-1336) ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: phone2 (314-537-1336)
localip: 99.56.191.170
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1689463252
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 43.174.166.154
userName: johndoe