WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=166.196.54.129 ::: message={"access_device":{"epkey":"EP8GO8UIPR83OS0AJ5O6","hostname":null,"ip":"23.56.103.157","location":{"city":"Cumming","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"166.196.54.129","key":"DP0W9R0H7R0WJ4GY2HK8","location":{"city":"Atlanta","country":"United States","state":"Georgia"},"name":"phone2 (314-537-1336)"},"email":"jbetro@acmeelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2022-09-16T11:21:45.456674+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1663327305,"txid":"8c0e235b-1668-4d13-a653-52b846d72a2e","user":{"groups":[],"key":"DUCOEHG5PIQG8MF7JIQ7","name":"janedoe"}} ::: clientIP=23.56.103.157 ::: userName=janedoe ::: created_at=1663327305 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1663327305 ::: clientHostname=phone2 (314-537-1336) ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1663327305
tags: ['DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 166.196.54.129
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: phone2 (314-537-1336)
streamName: DUO
clientIP: 23.56.103.157
userName: janedoe