WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2023-08-15T20:38:19.605Z","agent":{"ephemeral_id":"58f5da08-4b66-497e-b13a-b9936e61eb18","id":"106936a2-47e9-46b2-81b6-e23a3752c9b3","name":"EventSentry1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Syslog","code":"500","created":"2023-08-15T20:38:20.313Z","kind":"event","provider":"EventSentry Network Services"},"host":{"name":"EventSentry1.umbrella.org"},"log":{"level":"warning"},"message":"syslog@10.0.0.1[local4.warning]: Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:105.15.130.164 dst outside:39.184.109.123 (type 3, code 3) by access-group \"dmz_access_in\" [0x0, 0x0]","organization":"umbrella","senderHost":"EventSentry1.umbrella.org","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"EventSentry1.umbrella.org","event_data":{"param1":"10.0.0.1","param2":"local4","param3":"warning","param4":"Aug 15 2023 14:43:59: %ASA-4-106023: Deny icmp src dmz-1:105.15.130.164 dst outside:39.184.109.123 (type 3, code 3) by access-group \"dmz_access_in\" [0x0, 0x0]"},"event_id":"500","keywords":["Classic"],"opcode":"Info","provider_name":"EventSentry Network Services","record_id":1951580,"task":"Syslog"}}
Product: ASA Firewall
Vendor: Cisco