WitFoo-Artifact ::: message={"agent_load_flags":"0","agent_local_time":"2024-07-07T07:23:04.419Z","agent_version":"7.16.16903.0","bios_manufacturer":"Amazon EC2","bios_version":"1.0","chassis_type":"1","chassis_type_desc":"Other","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"16903","config_id_platform":"8","connection_ip":"117.210.59.1","connection_mac_address":"0a-ff-ef-c7-97-4b","cpu_signature":"329300","cpu_vendor":"0","default_gateway_ip":"10.240.6.1","deployment_type":"Standard","device_id":"6e0997fe1a25497a83d46446bddf7de7","device_policies":{"fim":{"applied":true,"applied_date":"2024-06-17T02:49:29.358478989Z","assigned_date":"2024-06-17T02:48:46.439246276Z","policy_id":"18bc7bad59ff40e48212debaafa69be7","policy_type":"fim","settings_hash":"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6"},"global_config":{"applied":true,"applied_date":"2024-07-07T07:24:53.047505764Z","assigned_date":"2024-07-07T07:23:39.084628587Z","policy_id":"342bff7c15ef474a8eb7e6635b9fddb0","policy_type":"globalconfig","settings_hash":"739c040"},"prevention":{"applied":true,"applied_date":"2024-06-17T01:30:26.019989851Z","assigned_date":"2024-06-17T01:30:04.441407846Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"},"remote_response":{"applied":true,"applied_date":"2024-06-17T02:36:06.379242792Z","assigned_date":"2024-06-17T02:35:05.811819649Z","policy_id":"80fa74fcb9c84b90bed01c4b76a7eaa3","policy_type":"remote-response","settings_hash":"17550b92"},"sensor_update":{"applied":true,"applied_date":"2024-06-26T23:31:46.359240462Z","assigned_date":"2024-06-26T23:29:17.697105987Z","policy_id":"cf70114f29204128b689d83524396e83","policy_type":"sensor-update","settings_hash":"tagged|5;","uninstall_protection":"UNKNOWN"}},"external_ip":"23.20.143.83","filesystem_containment_status":"normal","first_seen":"2024-06-17T01:06:16Z","group_hash":"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9","groups":["8c86687045fc4af494d67259fb834ea6"],"hostname":"NVIMGTDUO01","instance_id":"i-0bd0afbd46c079e34","kernel_version":"4.14.345-262.561.amzn2.x86_64","last_seen":"2024-07-08T11:32:39Z","linux_sensor_mode":"Kernel Mode","local_ip":"117.210.59.1","mac_address":"0a-ff-ef-c7-97-4b","major_version":"4","meta":{"version":"2269","version_string":"18:87926912830"},"minor_version":"14","modified_timestamp":"2024-07-08T11:32:40Z","os_version":"Amazon Linux 2","platform_id":"3","platform_name":"Linux","policies":[{"applied":true,"applied_date":"2024-06-17T01:30:26.019989851Z","assigned_date":"2024-06-17T01:30:04.441407846Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"}],"product_type_desc":"Server","provision_status":"NotProvisioned","reduced_functionality_mode":"no","serial_number":"ec2d50ce-1729-e688-3e1d-5ebbb6a15dad","service_provider":"AWS_EC2_V2","service_provider_account_id":"550132162628","status":"normal","system_manufacturer":"Amazon EC2","system_product_name":"t3.micro","tags":[],"zone_group":"us-east-1a"} ::: clientIP=117.210.59.1 ::: tags=[os=Amazon Linux 2,last_seen=2024-07-08T11:32:39Z,hardware_product=t3.micro,hardware_manufacturer=Amazon EC2] ::: program=crowdstrike_falcon ::: streamName=Crowdstrike Asset Inventory ::: clientHostname=NVIMGTDUO01 ::: clientGUID=6e0997fe1a25497a83d46446bddf7de7 ::: messageType=asset_inventory
{
    "clientGUID": "6e0997fe1a25497a83d46446bddf7de7",
    "clientHostname": "NVIMGTDUO01",
    "clientIP": "117.210.59.1",
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: message={\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-07-07T07:23:04.419Z\",\"agent_version\":\"7.16.16903.0\",\"bios_manufacturer\":\"Amazon EC2\",\"bios_version\":\"1.0\",\"chassis_type\":\"1\",\"chassis_type_desc\":\"Other\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"16903\",\"config_id_platform\":\"8\",\"connection_ip\":\"117.210.59.1\",\"connection_mac_address\":\"0a-ff-ef-c7-97-4b\",\"cpu_signature\":\"329300\",\"cpu_vendor\":\"0\",\"default_gateway_ip\":\"10.240.6.1\",\"deployment_type\":\"Standard\",\"device_id\":\"6e0997fe1a25497a83d46446bddf7de7\",\"device_policies\":{\"fim\":{\"applied\":true,\"applied_date\":\"2024-06-17T02:49:29.358478989Z\",\"assigned_date\":\"2024-06-17T02:48:46.439246276Z\",\"policy_id\":\"18bc7bad59ff40e48212debaafa69be7\",\"policy_type\":\"fim\",\"settings_hash\":\"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2024-07-07T07:24:53.047505764Z\",\"assigned_date\":\"2024-07-07T07:23:39.084628587Z\",\"policy_id\":\"342bff7c15ef474a8eb7e6635b9fddb0\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"739c040\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2024-06-17T01:30:26.019989851Z\",\"assigned_date\":\"2024-06-17T01:30:04.441407846Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2024-06-17T02:36:06.379242792Z\",\"assigned_date\":\"2024-06-17T02:35:05.811819649Z\",\"policy_id\":\"80fa74fcb9c84b90bed01c4b76a7eaa3\",\"policy_type\":\"remote-response\",\"settings_hash\":\"17550b92\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2024-06-26T23:31:46.359240462Z\",\"assigned_date\":\"2024-06-26T23:29:17.697105987Z\",\"policy_id\":\"cf70114f29204128b689d83524396e83\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|5;\",\"uninstall_protection\":\"UNKNOWN\"}},\"external_ip\":\"23.20.143.83\",\"filesystem_containment_status\":\"normal\",\"first_seen\":\"2024-06-17T01:06:16Z\",\"group_hash\":\"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9\",\"groups\":[\"8c86687045fc4af494d67259fb834ea6\"],\"hostname\":\"NVIMGTDUO01\",\"instance_id\":\"i-0bd0afbd46c079e34\",\"kernel_version\":\"4.14.345-262.561.amzn2.x86_64\",\"last_seen\":\"2024-07-08T11:32:39Z\",\"linux_sensor_mode\":\"Kernel Mode\",\"local_ip\":\"117.210.59.1\",\"mac_address\":\"0a-ff-ef-c7-97-4b\",\"major_version\":\"4\",\"meta\":{\"version\":\"2269\",\"version_string\":\"18:87926912830\"},\"minor_version\":\"14\",\"modified_timestamp\":\"2024-07-08T11:32:40Z\",\"os_version\":\"Amazon Linux 2\",\"platform_id\":\"3\",\"platform_name\":\"Linux\",\"policies\":[{\"applied\":true,\"applied_date\":\"2024-06-17T01:30:26.019989851Z\",\"assigned_date\":\"2024-06-17T01:30:04.441407846Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"}],\"product_type_desc\":\"Server\",\"provision_status\":\"NotProvisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"ec2d50ce-1729-e688-3e1d-5ebbb6a15dad\",\"service_provider\":\"AWS_EC2_V2\",\"service_provider_account_id\":\"550132162628\",\"status\":\"normal\",\"system_manufacturer\":\"Amazon EC2\",\"system_product_name\":\"t3.micro\",\"tags\":[],\"zone_group\":\"us-east-1a\"} ::: clientIP=117.210.59.1 ::: tags=[os=Amazon Linux 2,last_seen=2024-07-08T11:32:39Z,hardware_product=t3.micro,hardware_manufacturer=Amazon EC2] ::: program=crowdstrike_falcon ::: streamName=Crowdstrike Asset Inventory ::: clientHostname=NVIMGTDUO01 ::: clientGUID=6e0997fe1a25497a83d46446bddf7de7 ::: messageType=asset_inventory",
    "messageType": "asset_inventory",
    "program": "crowdstrike_falcon",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "Crowdstrike Asset Inventory",
    "tags": [
        "hardware_manufacturer=Amazon EC2",
        "Crowdstrike Asset Inventory",
        "hardware_product=t3.micro",
        "os=Amazon Linux 2",
        "last_seen=2024-07-08T11:32:39Z",
        "asset_inventory"
    ]
}