WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:14:35.242Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"510","created":"2024-07-26T13:14:35.782Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.wayne.com"},"log":{"level":"information"},"message":"More information for the event entry with Instance ID 61560646-da78-424d-a5c0-9d242ab08178. There may be more events with the same Instance ID with more information. \n \nInstance ID:  \n61560646-da78-424d-a5c0-9d242ab08178 \n \nDetails: \n{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate,  \nbr\",\"Accept-Language\":\"en-US,en;q=0.5\",\"Host\":\"adfs.wayne.com\",\"Referer\":\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026redirect_uri=ms-appx-web%3a{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, fMicrosoft.AAD.BrokerPlugin{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, fd3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026resource=https%3a{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, foutlook.office365.com{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f\\u0026add_account=multiple\\u0026pr \nompt=login\\u0026login_hint=lbizune%40wayne.com\\u0026response_mode=form_post\\u0026msafed=0\\u0026windows_api_version=2.0.1\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\",\"User-Agent\":\"Mozilla/5.0 (Windows  \nNT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\",\"X-MS-Endpoint-Absolute-Path\":\"/adfs/ls/\"} \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n-","organization":"wayne","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.wayne.com","event_data":{"param1":"61560646-da78-424d-a5c0-9d242ab08178","param10":"-","param11":"-","param12":"-","param13":"-","param14":"-","param15":"-","param16":"-","param17":"-","param18":"-","param19":"-","param2":"{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, ","param20":"-","param21":"-","param3":"br\",\"Accept-Language\":\"en-US,en;q=0.5\",\"Host\":\"adfs.wayne.com\",\"Referer\":\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026redirect_uri=ms-appx-web%3a%2f%2fMicrosoft.AAD.BrokerPlugin%2fd3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026resource=https%3a%2f%2foutlook.office365.com%2f\\u0026add_account=multiple\\u0026pr","param4":"ompt=login\\u0026login_hint=lbizune%40wayne.com\\u0026response_mode=form_post\\u0026msafed=0\\u0026windows_api_version=2.0.1\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\",\"User-Agent\":\"Mozilla/5.0 (Windows ","param5":"NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\",\"X-MS-Endpoint-Absolute-Path\":\"/adfs/ls/\"}","param6":"-","param7":"-","param8":"-","param9":"-"},"event_id":"510","keywords":["Audit Success","Classic"],"provider_name":"AD FS Auditing","record_id":1388042049,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:14:35.242Z\",\"agent\":{\"ephemeral_id\":\"2684bcd2-4a2b-4981-9139-d620c6b2af92\",\"id\":\"a5def5dd-6173-4dfd-bc91-3ca20122db53\",\"name\":\"Nordc-APP-ADFS1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"510\",\"created\":\"2024-07-26T13:14:35.782Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"AD FS Auditing\"},\"host\":{\"name\":\"Nordc-APP-ADFS1.wayne.com\"},\"log\":{\"level\":\"information\"},\"message\":\"More information for the event entry with Instance ID 61560646-da78-424d-a5c0-9d242ab08178. There may be more events with the same Instance ID with more information. \\n \\nInstance ID:  \\n61560646-da78-424d-a5c0-9d242ab08178 \\n \\nDetails: \\n{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate,  \\nbr\\\",\\\"Accept-Language\\\":\\\"en-US,en;q=0.5\\\",\\\"Host\\\":\\\"adfs.wayne.com\\\",\\\"Referer\\\":\\\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\\\u0026redirect_uri=ms-appx-web%3a{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, f{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, fMicrosoft.AAD.BrokerPlugin{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, fd3590ed6-52b3-4102-aeff-aad2292ab01c\\\\u0026resource=https%3a{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, f{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, foutlook.office365.com{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, f\\\\u0026add_account=multiple\\\\u0026pr \\nompt=login\\\\u0026login_hint=lbizune%40wayne.com\\\\u0026response_mode=form_post\\\\u0026msafed=0\\\\u0026windows_api_version=2.0.1\\\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\\\",\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows  \\nNT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\\\",\\\"X-MS-Endpoint-Absolute-Path\\\":\\\"/adfs/ls/\\\"} \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n- \\n-\",\"organization\":\"wayne\",\"senderHost\":\"192.168.10.55\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Nordc-APP-ADFS1.wayne.com\",\"event_data\":{\"param1\":\"61560646-da78-424d-a5c0-9d242ab08178\",\"param10\":\"-\",\"param11\":\"-\",\"param12\":\"-\",\"param13\":\"-\",\"param14\":\"-\",\"param15\":\"-\",\"param16\":\"-\",\"param17\":\"-\",\"param18\":\"-\",\"param19\":\"-\",\"param2\":\"{\\\"Upgrade-Insecure-Requests\\\":\\\"1\\\",\\\"Connection\\\":\\\"Keep-Alive\\\",\\\"Accept\\\":\\\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\\",\\\"Accept-Encoding\\\":\\\"gzip, deflate, \",\"param20\":\"-\",\"param21\":\"-\",\"param3\":\"br\\\",\\\"Accept-Language\\\":\\\"en-US,en;q=0.5\\\",\\\"Host\\\":\\\"adfs.wayne.com\\\",\\\"Referer\\\":\\\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\\\u0026redirect_uri=ms-appx-web%3a%2f%2fMicrosoft.AAD.BrokerPlugin%2fd3590ed6-52b3-4102-aeff-aad2292ab01c\\\\u0026resource=https%3a%2f%2foutlook.office365.com%2f\\\\u0026add_account=multiple\\\\u0026pr\",\"param4\":\"ompt=login\\\\u0026login_hint=lbizune%40wayne.com\\\\u0026response_mode=form_post\\\\u0026msafed=0\\\\u0026windows_api_version=2.0.1\\\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\\\",\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows \",\"param5\":\"NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\\\",\\\"X-MS-Endpoint-Absolute-Path\\\":\\\"/adfs/ls/\\\"}\",\"param6\":\"-\",\"param7\":\"-\",\"param8\":\"-\",\"param9\":\"-\"},\"event_id\":\"510\",\"keywords\":[\"Audit Success\",\"Classic\"],\"provider_name\":\"AD FS Auditing\",\"record_id\":1388042049,\"user\":{\"domain\":\"MDS-ATL\",\"identifier\":\"S-1-5-21-1725571127-999974082-2044928816-27902\",\"name\":\"adfs\",\"type\":\"User\"}}}",
    "messageType": "510",
    "senderHost": "192.168.10.55",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "ad fs auditing",
    "tags": [
        "v8",
        "eventId:510",
        "ad fs auditing",
        "510"
    ],
    "vendorCode": "1388042049"
}