WitFoo-Artifact ::: clientHostname=NCAMGTDUO01 ::: program=crowdstrike_falcon ::: clientGUID=8e03cafcab204e75a3cd2b31bdc68cc4 ::: tags=[os=Amazon Linux 2,last_seen=2024-07-10T00:47:36Z,hardware_product=t3.micro,hardware_manufacturer=Amazon EC2] ::: message={"agent_load_flags":"0","agent_local_time":"2024-06-26T23:09:20.866Z","agent_version":"7.16.16903.0","bios_manufacturer":"Amazon EC2","bios_version":"1.0","chassis_type":"1","chassis_type_desc":"Other","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"16903","config_id_platform":"8","connection_ip":"24.179.5.28","connection_mac_address":"06-3c-f6-ae-99-17","cpu_signature":"329303","cpu_vendor":"0","default_gateway_ip":"10.248.6.1","deployment_type":"Standard","device_id":"8e03cafcab204e75a3cd2b31bdc68cc4","device_policies":{"fim":{"applied":true,"applied_date":"2024-06-12T01:21:54.325964953Z","assigned_date":"2024-06-12T01:20:43.098556718Z","policy_id":"18bc7bad59ff40e48212debaafa69be7","policy_type":"fim","settings_hash":"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6"},"global_config":{"applied":true,"applied_date":"2024-06-26T23:11:24.283425784Z","assigned_date":"2024-06-26T23:09:24.330783208Z","policy_id":"342bff7c15ef474a8eb7e6635b9fddb0","policy_type":"globalconfig","settings_hash":"739c040"},"prevention":{"applied":true,"applied_date":"2024-06-12T01:26:57.164897369Z","assigned_date":"2024-06-12T01:26:18.114898832Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"},"remote_response":{"applied":true,"applied_date":"2024-06-12T01:21:54.14275706Z","assigned_date":"2024-06-12T01:20:43.098269143Z","policy_id":"80fa74fcb9c84b90bed01c4b76a7eaa3","policy_type":"remote-response","settings_hash":"17550b92"},"sensor_update":{"applied":true,"applied_date":"2024-06-26T23:11:24.267812398Z","assigned_date":"2024-06-26T23:08:29.122998794Z","policy_id":"cf70114f29204128b689d83524396e83","policy_type":"sensor-update","settings_hash":"tagged|5;","uninstall_protection":"UNKNOWN"}},"external_ip":"52.8.6.16","filesystem_containment_status":"normal","first_seen":"2024-06-12T01:07:01Z","group_hash":"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9","groups":["8c86687045fc4af494d67259fb834ea6"],"hostname":"NCAMGTDUO01","instance_id":"i-02d83c92b3956ad5e","kernel_version":"4.14.336-257.568.amzn2.x86_64","last_seen":"2024-07-10T00:47:36Z","linux_sensor_mode":"Kernel Mode","local_ip":"24.179.5.28","mac_address":"06-3c-f6-ae-99-17","major_version":"4","meta":{"version":"2920","version_string":"18:88142009808"},"minor_version":"14","modified_timestamp":"2024-07-10T00:48:29Z","os_version":"Amazon Linux 2","platform_id":"3","platform_name":"Linux","policies":[{"applied":true,"applied_date":"2024-06-12T01:26:57.164897369Z","assigned_date":"2024-06-12T01:26:18.114898832Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"}],"product_type_desc":"Server","provision_status":"NotProvisioned","reduced_functionality_mode":"no","serial_number":"ec2eb559-9272-536f-c213-d817d3c1aa21","service_provider":"AWS_EC2_V2","service_provider_account_id":"550132162628","status":"normal","system_manufacturer":"Amazon EC2","system_product_name":"t3.micro","tags":[],"zone_group":"us-west-1a"} ::: clientIP=24.179.5.28 ::: messageType=asset_inventory ::: streamName=Crowdstrike Asset Inventory
{
    "clientGUID": "8e03cafcab204e75a3cd2b31bdc68cc4",
    "clientHostname": "NCAMGTDUO01",
    "clientIP": "24.179.5.28",
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: clientHostname=NCAMGTDUO01 ::: program=crowdstrike_falcon ::: clientGUID=8e03cafcab204e75a3cd2b31bdc68cc4 ::: tags=[os=Amazon Linux 2,last_seen=2024-07-10T00:47:36Z,hardware_product=t3.micro,hardware_manufacturer=Amazon EC2] ::: message={\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-06-26T23:09:20.866Z\",\"agent_version\":\"7.16.16903.0\",\"bios_manufacturer\":\"Amazon EC2\",\"bios_version\":\"1.0\",\"chassis_type\":\"1\",\"chassis_type_desc\":\"Other\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"16903\",\"config_id_platform\":\"8\",\"connection_ip\":\"24.179.5.28\",\"connection_mac_address\":\"06-3c-f6-ae-99-17\",\"cpu_signature\":\"329303\",\"cpu_vendor\":\"0\",\"default_gateway_ip\":\"10.248.6.1\",\"deployment_type\":\"Standard\",\"device_id\":\"8e03cafcab204e75a3cd2b31bdc68cc4\",\"device_policies\":{\"fim\":{\"applied\":true,\"applied_date\":\"2024-06-12T01:21:54.325964953Z\",\"assigned_date\":\"2024-06-12T01:20:43.098556718Z\",\"policy_id\":\"18bc7bad59ff40e48212debaafa69be7\",\"policy_type\":\"fim\",\"settings_hash\":\"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2024-06-26T23:11:24.283425784Z\",\"assigned_date\":\"2024-06-26T23:09:24.330783208Z\",\"policy_id\":\"342bff7c15ef474a8eb7e6635b9fddb0\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"739c040\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2024-06-12T01:26:57.164897369Z\",\"assigned_date\":\"2024-06-12T01:26:18.114898832Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2024-06-12T01:21:54.14275706Z\",\"assigned_date\":\"2024-06-12T01:20:43.098269143Z\",\"policy_id\":\"80fa74fcb9c84b90bed01c4b76a7eaa3\",\"policy_type\":\"remote-response\",\"settings_hash\":\"17550b92\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2024-06-26T23:11:24.267812398Z\",\"assigned_date\":\"2024-06-26T23:08:29.122998794Z\",\"policy_id\":\"cf70114f29204128b689d83524396e83\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|5;\",\"uninstall_protection\":\"UNKNOWN\"}},\"external_ip\":\"52.8.6.16\",\"filesystem_containment_status\":\"normal\",\"first_seen\":\"2024-06-12T01:07:01Z\",\"group_hash\":\"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9\",\"groups\":[\"8c86687045fc4af494d67259fb834ea6\"],\"hostname\":\"NCAMGTDUO01\",\"instance_id\":\"i-02d83c92b3956ad5e\",\"kernel_version\":\"4.14.336-257.568.amzn2.x86_64\",\"last_seen\":\"2024-07-10T00:47:36Z\",\"linux_sensor_mode\":\"Kernel Mode\",\"local_ip\":\"24.179.5.28\",\"mac_address\":\"06-3c-f6-ae-99-17\",\"major_version\":\"4\",\"meta\":{\"version\":\"2920\",\"version_string\":\"18:88142009808\"},\"minor_version\":\"14\",\"modified_timestamp\":\"2024-07-10T00:48:29Z\",\"os_version\":\"Amazon Linux 2\",\"platform_id\":\"3\",\"platform_name\":\"Linux\",\"policies\":[{\"applied\":true,\"applied_date\":\"2024-06-12T01:26:57.164897369Z\",\"assigned_date\":\"2024-06-12T01:26:18.114898832Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"}],\"product_type_desc\":\"Server\",\"provision_status\":\"NotProvisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"ec2eb559-9272-536f-c213-d817d3c1aa21\",\"service_provider\":\"AWS_EC2_V2\",\"service_provider_account_id\":\"550132162628\",\"status\":\"normal\",\"system_manufacturer\":\"Amazon EC2\",\"system_product_name\":\"t3.micro\",\"tags\":[],\"zone_group\":\"us-west-1a\"} ::: clientIP=24.179.5.28 ::: messageType=asset_inventory ::: streamName=Crowdstrike Asset Inventory",
    "messageType": "asset_inventory",
    "program": "crowdstrike_falcon",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "Crowdstrike Asset Inventory",
    "tags": [
        "hardware_manufacturer=Amazon EC2",
        "Crowdstrike Asset Inventory",
        "hardware_product=t3.micro",
        "os=Amazon Linux 2",
        "last_seen=2024-07-10T00:47:36Z",
        "asset_inventory"
    ]
}