WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=40.135.154.219 ::: message={"access_device":{"epkey":null,"hostname":null,"ip":"40.135.154.219","location":{"city":"Suwanee","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"40.135.154.219","key":"DPSIKHUSM0JIU4Y2CSCH","location":{"city":"Suwanee","country":"United States","state":"Georgia"},"name":"678-232-3375"},"email":"nighthawk@wayneelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-02-28T13:14:50.713026+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1677590090,"txid":"7846a8d7-9d7f-4b6c-9d52-dfd91e6f6eee","user":{"groups":[],"key":"DU46KG199M41WHFC7M4K","name":"nighthawk"}} ::: clientIP=40.135.154.219 ::: userName=nighthawk ::: created_at=1677590090 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1677590090 ::: clientHostname=678-232-3375 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1677590090
tags: ['DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 75.63.121.145
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: 678-232-3375
streamName: DUO
clientIP: 40.135.154.219
userName: nighthawk