WitFoo-Artifact ::: streamName=Okta ::: clientIP=211.23.52.149 ::: clientGUID=cappT0Hfy97F1BoO1UTR ::: messageType=auth_failure ::: message={"actor":{"alternateId":"charlie","detailEntry":null,"displayName":"TAnderson Admin","id":"00u1768rxuCoeW0Qm697","type":"User"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"trs5KMBNacQR_qXpQxXRaNp6A","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Las Vegas","country":"United States","geolocation":{"lat":36.1685,"lon":-115.1164},"postalCode":"89101","state":"Nevada"},"id":"cappT0Hfy97F1BoO1UTR","ipAddress":"211.23.52.149","userAgent":{"browser":"UNKNOWN","os":"Windows 8","rawUserAgent":"Okta AD Agent/3.16.1 (Microsoft Windows NT 6.2.9200.0; .NET CLR 4.0.30319.42000; 64-bit OS; 64-bit Process; sslpinning=disabled)"},"zone":"null"},"debugContext":{"debugData":{"dtHash":"6f9aadba8adbed6cc725293f82e786b12e8cbbf43909b90f570b2a356f6fa8ff","requestId":"c4a094fc2f12952a070908ecdd8c2407","requestUri":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a539kiyvwggVTfYyD697/actionResult","url":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a539kiyvwggVTfYyD697/actionResult?responseId=0e41fe30-b4f7-4fb2-bb0f-cb7d025eaf8f"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.agent.user_auth.error","outcome":{"reason":"Login Failed","result":"FAILURE"},"published":"2024-02-20T19:31:32.253Z","request":{"ipChain":[{"geographicalContext":{"city":"Las Vegas","country":"United States","geolocation":{"lat":36.1685,"lon":-115.1164},"postalCode":"89101","state":"Nevada"},"ip":"211.23.52.149","source":null,"version":"V4"}]},"securityContext":{"asNumber":174,"asOrg":"psinet  inc.","domain":"cogentco.com","isProxy":false,"isp":"cogent communications"},"severity":"ERROR","target":[{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{"requestApiTokenId":"00T144bkn6dBONmdv697"},"id":"c4a094fc2f12952a070908ecdd8c2407","type":"WEB"},"uuid":"a6e69cfb-d026-11ee-a353-0f4ca5dacf67","version":"0"} ::: severityLabel=ERROR ::: userName=charlie ::: program=okta ::: action=FAILURE ::: severityCode=2
This is a syslog message from a product called Okta by Okta. The following fields were extracted from the message:
action: FAILURE
clientguid: cappT0Hfy97F1BoO1UTR
messagetype: auth_failure
productids: [6]
program: okta
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
tags: ['Okta', 'auth_failure']
streamName: Okta
clientIP: 211.23.52.149
userName: charlie