WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-06-03T13:43:44.409Z","agent":{"ephemeral_id":"78920bdf-4a2e-4300-8053-28c4dd516820","id":"28bdd222-7530-4834-9668-d3c657ba1905","name":"CitrixControl2","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"4625","created":"2024-06-03T13:43:45.954Z","kind":"event","outcome":"failure","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"CitrixControl2.acme.org"},"log":{"level":"information"},"message":"An account failed to log on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Type:\t\t\t3\n\nAccount For Which Logon Failed:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\talice\n\tAccount Domain:\t\tacme.org\n\nFailure Information:\n\tFailure Reason:\t\tUnknown user name or bad password.\n\tStatus:\t\t\t0xC000006D\n\tSub Status:\t\t0xC000006A\n\nProcess Information:\n\tCaller Process ID:\t0x0\n\tCaller Process Name:\t-\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t70.57.223.168\n\tSource Port:\t\t60674\n\nDetailed Authentication Information:\n\tLogon Process:\t\tNtLmSsp \n\tAuthentication Package:\tNTLM\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\n\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\n\nThe Process Information fields indicate which account and process on the system requested the logon.\n\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","organization":"acme","senderHost":"CitrixControl2.acme.org","sensitivity":"normal","winlog":{"activity_id":"{e4200963-44e0-4ad5-8c1f-c590bc918a98}","api":"wineventlog","channel":"Security","computer_name":"CitrixControl2.acme.org","event_data":{"AuthenticationPackageName":"NTLM","FailureReason":"%%2313","IpAddress":"70.57.223.168","IpPort":"60674","KeyLength":"0","LmPackageName":"-","LogonProcessName":"NtLmSsp ","LogonType":"3","ProcessId":"0x0","ProcessName":"-","Status":"0xc000006d","SubStatus":"0xc000006a","SubjectDomainName":"-","SubjectLogonId":"0x0","SubjectUserName":"-","SubjectUserSid":"S-1-0-0","TargetDomainName":"acme.org","TargetUserName":"alice","TargetUserSid":"S-1-0-0","TransmittedServices":"-","WorkstationName":"-"},"event_id":"4625","keywords":["Audit Failure"],"opcode":"Info","process":{"pid":732,"thread":{"id":3136}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":6352619,"task":"Logon"}}
{
    "action": "Logon",
    "clientport": 60674,
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-06-03T13:43:44.409Z\",\"agent\":{\"ephemeral_id\":\"78920bdf-4a2e-4300-8053-28c4dd516820\",\"id\":\"28bdd222-7530-4834-9668-d3c657ba1905\",\"name\":\"CitrixControl2\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Logon\",\"code\":\"4625\",\"created\":\"2024-06-03T13:43:45.954Z\",\"kind\":\"event\",\"outcome\":\"failure\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"CitrixControl2.acme.org\"},\"log\":{\"level\":\"information\"},\"message\":\"An account failed to log on.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-0-0\\n\\tAccount Name:\\t\\t-\\n\\tAccount Domain:\\t\\t-\\n\\tLogon ID:\\t\\t0x0\\n\\nLogon Type:\\t\\t\\t3\\n\\nAccount For Which Logon Failed:\\n\\tSecurity ID:\\t\\tS-1-0-0\\n\\tAccount Name:\\t\\talice\\n\\tAccount Domain:\\t\\tacme.org\\n\\nFailure Information:\\n\\tFailure Reason:\\t\\tUnknown user name or bad password.\\n\\tStatus:\\t\\t\\t0xC000006D\\n\\tSub Status:\\t\\t0xC000006A\\n\\nProcess Information:\\n\\tCaller Process ID:\\t0x0\\n\\tCaller Process Name:\\t-\\n\\nNetwork Information:\\n\\tWorkstation Name:\\t-\\n\\tSource Network Address:\\t70.57.223.168\\n\\tSource Port:\\t\\t60674\\n\\nDetailed Authentication Information:\\n\\tLogon Process:\\t\\tNtLmSsp \\n\\tAuthentication Package:\\tNTLM\\n\\tTransited Services:\\t-\\n\\tPackage Name (NTLM only):\\t-\\n\\tKey Length:\\t\\t0\\n\\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\\n\\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\n\\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\\n\\nThe Process Information fields indicate which account and process on the system requested the logon.\\n\\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\n\\nThe authentication information fields provide detailed information about this specific logon request.\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\",\"organization\":\"acme\",\"senderHost\":\"CitrixControl2.acme.org\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{e4200963-44e0-4ad5-8c1f-c590bc918a98}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"CitrixControl2.acme.org\",\"event_data\":{\"AuthenticationPackageName\":\"NTLM\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"70.57.223.168\",\"IpPort\":\"60674\",\"KeyLength\":\"0\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":\"3\",\"ProcessId\":\"0x0\",\"ProcessName\":\"-\",\"Status\":\"0xc000006d\",\"SubStatus\":\"0xc000006a\",\"SubjectDomainName\":\"-\",\"SubjectLogonId\":\"0x0\",\"SubjectUserName\":\"-\",\"SubjectUserSid\":\"S-1-0-0\",\"TargetDomainName\":\"acme.org\",\"TargetUserName\":\"alice\",\"TargetUserSid\":\"S-1-0-0\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"-\"},\"event_id\":\"4625\",\"keywords\":[\"Audit Failure\"],\"opcode\":\"Info\",\"process\":{\"pid\":732,\"thread\":{\"id\":3136}},\"provider_guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":6352619,\"task\":\"Logon\"}}",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "senderhost": "CitrixControl2.uwca.org",
    "sensitivity": "normal",
    "severitylabel": "Info",
    "sourceinfo": "unknown",
    "tags": [
        "v8",
        "eventId:4625",
        "microsoft-windows-security-auditing",
        "auth_failure"
    ],
    "vendorcode": "6352619",
    "streamName": "microsoft-windows-security-auditing",
    "clientIP": "70.57.223.168",
    "userName": "alice"
}