<110>2024-07-26T09:02:14.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ComputerMgmtReports ]  [ REPORT_PROFILE = Modified Computers ]  [ COMP_MGMT_TYPE = Password Last Set ]  [ TIME_GENERATED = 1721998934 ]  [ FORMAT_MESSAGE = Computer account 'L-BM81533$' was changed by 'NT AUTHORITY\ANONYMOUS LOGON'. Changed Attributes : 'Password Last Set' ]  [ ACCOUNT_NAME = L-BM81533$ ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-36880} ]  [ CALLER_USER_NAME = ANONYMOUS LOGON ]  [ CALLER_USER_DOMAIN = NT AUTHORITY ]  [ CALLER_LOGON_ID = 0x3e6 ]  [ SOURCE = NORDC-DC-01.umbrella.com ]  [ EVENT_NUMBER = 4742 ]  [ REMARKS = A computer account was changed. ]  [ RECORD_NUMBER = 6067926668 ]  [ CALLER_USER_SID = S-1-5-7 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = L-BM81533 ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=L-BM81533,OU=Laptops Windows 10,OU=Laptops,OU=Corp-Computers,DC=umbrella,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {8D0EBC81-52AD-42A2-99D3-C6F0C7CDE7C5} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = Anonymous Logon ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = CN=Anonymous Logon,CN=WellKnown Security Principals,CN=Configuration,DC=umbrella,DC=com ]  [ CALLER_USER_OU_GUID = CN=WellKnown Security Principals,CN=Configuration,DC=umbrella,DC=com ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ UAC_VALUE = - ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] 
This is a syslog message from a product called ManageEngine ADManager by ManageEngine. The following fields were extracted from the message:
facilityCode: 13
facilityLabel: log audit
fieldExtractorName: ad_audit_plus
localHostname: Nordc-app-Dell
localStartTime: 2024-07-26T09:02:14.000-04:00
messageType: audit_log
priority: 110
program: ADAuditPlus
senderHost: 192.168.10.233
sensitivity: normal
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: ad_audit_plus
tags: ['rfc3164', 'ad_audit_plus', 'audit_log']