WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=204.175.114.4 ::: message={"access_device":{"epkey":"EPQXW0YC48CI1GV4ERJZ","hostname":null,"ip":"204.175.114.4","location":{"city":"Marietta","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"204.175.114.4","key":"DP62TDIDPH3QFN365PD1","location":{"city":"Marietta","country":"United States","state":"Georgia"},"name":"678-472-2598"},"email":"fish@umbrellautilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-08-31T14:14:31.117594+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1693491271,"trusted_endpoint_status":"unknown","txid":"6a47d7fb-be69-49e9-959c-0c3219e58739","user":{"groups":[],"key":"DUF0A450P6CA3TIBZTP1","name":"fish"}} ::: clientIP=204.175.114.4 ::: userName=fish ::: created_at=1693491271 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1693491271 ::: clientHostname=678-472-2598 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 678-472-2598
localip: 98.251.3.228
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1693491271
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 204.175.114.4
userName: fish