WitFoo-Artifact ::: program=cisco_duo ::: message={"access_device":{"browser":null,"browser_version":null,"epkey":null,"flash_version":null,"hostname":"NORDC-APP-SXTASK","ip":"127.0.0.1","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":null,"os_version":null},"adaptive_trust_assessments":{},"alias":"unknown","application":{"key":"DIR75ZP575GMX3E3CEZE","name":"Microsoft RDP"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"authentication","factor":"not_available","isotimestamp":"2024-07-27T00:30:03.833893+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"allow_unenrolled_user","result":"success","timestamp":1722040203,"trusted_endpoint_status":"unknown","txid":"f3a77c88-156f-4e1f-ac5b-af238cbcc653","user":{"groups":[],"key":null,"name":"rpa03"}} ::: tags=[allow_unenrolled_user] ::: messageType=auth_success ::: streamName=DUO Asset Inventory
{
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: program=cisco_duo ::: message={\"access_device\":{\"browser\":null,\"browser_version\":null,\"epkey\":null,\"flash_version\":null,\"hostname\":\"NORDC-APP-SXTASK\",\"ip\":\"127.0.0.1\",\"is_encryption_enabled\":\"unknown\",\"is_firewall_enabled\":\"unknown\",\"is_password_set\":\"unknown\",\"java_version\":null,\"location\":{\"city\":null,\"country\":null,\"state\":null},\"os\":null,\"os_version\":null},\"adaptive_trust_assessments\":{},\"alias\":\"unknown\",\"application\":{\"key\":\"DIR75ZP575GMX3E3CEZE\",\"name\":\"Microsoft RDP\"},\"auth_device\":{\"ip\":null,\"key\":null,\"location\":{\"city\":null,\"country\":null,\"state\":null},\"name\":null},\"email\":null,\"event_type\":\"authentication\",\"factor\":\"not_available\",\"isotimestamp\":\"2024-07-27T00:30:03.833893+00:00\",\"ood_software\":null,\"rbfs_triggered_attacks\":null,\"reason\":\"allow_unenrolled_user\",\"result\":\"success\",\"timestamp\":1722040203,\"trusted_endpoint_status\":\"unknown\",\"txid\":\"f3a77c88-156f-4e1f-ac5b-af238cbcc653\",\"user\":{\"groups\":[],\"key\":null,\"name\":\"rpa03\"}} ::: tags=[allow_unenrolled_user] ::: messageType=auth_success ::: streamName=DUO Asset Inventory",
    "messageType": "auth_success",
    "program": "cisco_duo",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "DUO Asset Inventory",
    "tags": [
        "allow_unenrolled_user",
        "DUO Asset Inventory",
        "auth_success"
    ]
}