WitFoo-Artifact ::: program=cisco_duo ::: tags=[remembered_device] ::: messageType=auth_success ::: message={"access_device":{"browser":"DuoWinLogon","browser_version":"4.2.0","epkey":null,"flash_version":null,"hostname":"L-35VVHG3","ip":"0.0.0.0","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":"Windows","os_version":"10.0.19045.4651"},"adaptive_trust_assessments":{},"alias":"unknown","application":{"key":"DIR75ZP575GMX3E3CEZE","name":"Microsoft RDP"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T18:38:29.000000+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","result":"success","timestamp":1722019109,"trusted_endpoint_status":"unknown","txid":"0ad0185d-74ae-4e97-888f-444b2bbb4329","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DU1RF49D0CBYUO5XPO9Y","name":"alackman"}} ::: streamName=DUO Asset Inventory
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: auth_success
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['remembered_device', 'DUO Asset Inventory', 'auth_success']