WitFoo-Artifact ::: tags=["result=denied","reason=no_response"] ::: localIP=null ::: message={"access_device":{"browser":"Chrome","browser_version":"119.0.6045.106","epkey":"EP8RPG5J5CAIMYKFL2VL","flash_version":"uninstalled","hostname":null,"ip":"215.33.92.143","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Lawrenceville","country":"United States","state":"Georgia"},"os":"Windows","os_version":"10"},"adaptive_trust_assessments":{"more_secure_auth":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"reason":"Normal level of trust; no detection of known attack pattern","trust_level":"NORMAL"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Novel Access IP","trust_level":"LOW"}},"alias":"","application":{"key":"DIK6UXC7JCVKZD6LJEQG","name":"OEA - Production (Duo SSO)"},"auth_device":{"ip":null,"key":"DPAZ4ORE3VJDXJRV5A9D","location":{"city":null,"country":null,"state":null},"name":"770-899-2840"},"email":"johndoe@wayne.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-11-07T16:05:29.971888+00:00","ood_software":null,"reason":"no_response","result":"denied","timestamp":1699373129,"trusted_endpoint_status":"unknown","txid":"fb202a55-570f-4937-bfc3-7b1d34a53fc0","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DURLYG73XXK7GV81JECW","name":"johndoe"}} ::: program=Chrome ::: clientIP=215.33.92.143 ::: userName=johndoe ::: created_at=1699373129 ::: streamName=DUO ::: application=OEA - Production (Duo SSO) ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1699373129 ::: clientHostname=770-899-2840 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: OEA - Production (Duo SSO)
clienthostname: 770-899-2840
localip: null
messagetype: credential_access
program: Chrome
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1699373129
tags: ['result=denied', 'reason=no_response', 'DUO', 'credential_access']
streamName: DUO
clientIP: 215.33.92.143
userName: johndoe