WitFoo-Artifact ::: message={"actor":{"alternateId":"janedoe","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxd5VZMxD0R-2O_dEfoBFq0Q","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":34.0544,"lon":-118.2441},"postalCode":"90060","state":"California"},"id":null,"ipAddress":"205.145.20.189","userAgent":{"browser":"IE11","os":"Windows 8","rawUserAgent":"Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs05a.auw2-ok14.internal//1707493987576//07c4dd2003ef2219746cf7d5ab9ac469:dd209160-e0c7-4a12-8821-5013b6deb9fa:","agentid":"a532lo6a4sAZS1Lht697","authnRequestId":"a16ceea027a096c6730e73d1cbb78d6d","delauthtimeout":"4000","delauthtimespentatagent":"31","delauthtimespentatdomaincontroller":"31","delauthtimetotal":"129","deviceFingerprint":"b0577515316ff08d7d102031ef562336","dtHash":"cd399b4dd01e7432eca3fed8a1ad18437be7b7e602d60efcd101ad46b6aa6cff","errorCode":"1326","requestId":"07c4dd2003ef2219746cf7d5ab9ac469","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T15:53:03.706Z","request":{"ipChain":[{"geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":34.0544,"lon":-118.2441},"postalCode":"90060","state":"California"},"ip":"205.145.20.189","source":null,"version":"V4"}]},"securityContext":{"asNumber":14593,"asOrg":"spacex services  inc.","domain":"starlinkisp.net","isProxy":false,"isp":"space exploration technologies corporation"},"severity":"ERROR","target":[{"alternateId":"adorudian@stark.bank","detailEntry":null,"displayName":"Alex Dorudian","id":"0ua16z1jyxbaEARh9697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"07c4dd2003ef2219746cf7d5ab9ac469","type":"WEB"},"uuid":"4f0dd405-c763-11ee-841f-d10e07c0cb55","version":"0"} ::: messageType=auth_failure ::: action=FAILURE ::: streamName=Okta ::: userName=janedoe ::: clientIP=205.145.20.189 ::: severityCode=2 ::: severityLabel=ERROR ::: program=okta
{
    "action": "FAILURE",
    "message": "WitFoo-Artifact ::: message={\"actor\":{\"alternateId\":\"janedoe\",\"detailEntry\":null,\"displayName\":\"Okta System\",\"id\":\"spr16ygr5qFPw1bhs697\",\"type\":\"SystemPrincipal\"},\"authenticationContext\":{\"authenticationProvider\":\"ACTIVE_DIRECTORY\",\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":\"PASSWORD\",\"externalSessionId\":\"idxd5VZMxD0R-2O_dEfoBFq0Q\",\"interface\":\"AD APP Instance\",\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Los Angeles\",\"country\":\"United States\",\"geolocation\":{\"lat\":34.0544,\"lon\":-118.2441},\"postalCode\":\"90060\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"205.145.20.189\",\"userAgent\":{\"browser\":\"IE11\",\"os\":\"Windows 8\",\"rawUserAgent\":\"Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"actionid\":\"rpc::app.active_directory.agent.reply.ok14-majorecs05a.auw2-ok14.internal//1707493987576//07c4dd2003ef2219746cf7d5ab9ac469:dd209160-e0c7-4a12-8821-5013b6deb9fa:\",\"agentid\":\"a532lo6a4sAZS1Lht697\",\"authnRequestId\":\"a16ceea027a096c6730e73d1cbb78d6d\",\"delauthtimeout\":\"4000\",\"delauthtimespentatagent\":\"31\",\"delauthtimespentatdomaincontroller\":\"31\",\"delauthtimetotal\":\"129\",\"deviceFingerprint\":\"b0577515316ff08d7d102031ef562336\",\"dtHash\":\"cd399b4dd01e7432eca3fed8a1ad18437be7b7e602d60efcd101ad46b6aa6cff\",\"errorCode\":\"1326\",\"requestId\":\"07c4dd2003ef2219746cf7d5ab9ac469\",\"requestUri\":\"/idp/idx/identify\",\"threatSuspected\":\"false\",\"url\":\"/idp/idx/identify?\"}},\"device\":null,\"displayMessage\":\"Authenticate user with AD agent\",\"eventType\":\"user.authentication.auth_via_AD_agent\",\"legacyEventType\":\"app.ad.login.bad_password\",\"outcome\":{\"reason\":\"Authentication failed: bad username or password\",\"result\":\"FAILURE\"},\"published\":\"2024-02-09T15:53:03.706Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Los Angeles\",\"country\":\"United States\",\"geolocation\":{\"lat\":34.0544,\"lon\":-118.2441},\"postalCode\":\"90060\",\"state\":\"California\"},\"ip\":\"205.145.20.189\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":14593,\"asOrg\":\"spacex services  inc.\",\"domain\":\"starlinkisp.net\",\"isProxy\":false,\"isp\":\"space exploration technologies corporation\"},\"severity\":\"ERROR\",\"target\":[{\"alternateId\":\"adorudian@stark.bank\",\"detailEntry\":null,\"displayName\":\"Alex Dorudian\",\"id\":\"0ua16z1jyxbaEARh9697\",\"type\":\"AppUser\"},{\"alternateId\":\"SDPB.LOCAL\",\"detailEntry\":null,\"displayName\":\"Active Directory\",\"id\":\"0oa16yxhp6iUzuI2b697\",\"type\":\"AppInstance\"}],\"transaction\":{\"detail\":{},\"id\":\"07c4dd2003ef2219746cf7d5ab9ac469\",\"type\":\"WEB\"},\"uuid\":\"4f0dd405-c763-11ee-841f-d10e07c0cb55\",\"version\":\"0\"} ::: messageType=auth_failure ::: action=FAILURE ::: streamName=Okta ::: userName=janedoe ::: clientIP=205.145.20.189 ::: severityCode=2 ::: severityLabel=ERROR ::: program=okta",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "program": "okta",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "tags": [
        "Okta",
        "auth_failure"
    ],
    "streamName": "Okta",
    "clientIP": "205.145.20.189",
    "userName": "janedoe"
}