WitFoo-Artifact ::: userName=alice ::: messageType=asset_inventory ::: streamName=Microsoft Graph Asset Inventory ::: tags=[mail=adjarrett@bcbsal.org,surname=Jarrett,jobTitle=Guest,givenName=Angela,displayName=Angela Jarrett] ::: message={"businessPhones":[],"displayName":"Angela Jarrett","givenName":"Angela","id":"eb1e0fb4-a464-471d-8857-9662949191db","jobTitle":"Guest","mail":"adjarrett@bcbsal.org","mobilePhone":null,"officeLocation":null,"preferredLanguage":null,"surname":"Jarrett","userPrincipalName":"alice"} ::: program=microsoft_graph
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: microsoft_graph
senderHost: WitFoo-Streamer2.uwca.org
sensitivity: normal
sourceInfo: unknown
streamName: Microsoft Graph Asset Inventory
tags: ['mail=adjarrett@bcbsal.org', 'displayName=Angela Jarrett', 'Microsoft Graph Asset Inventory', 'jobTitle=Guest', 'givenName=Angela', 'asset_inventory', 'surname=Jarrett']
userName: alice