WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.oscorp.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72 is about to expire or already expired.","organization":"oscorp","senderHost":"nordc-app-fs01.oscorp.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.oscorp.com","event_data":{"Context":"local system","ObjId":"12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284646,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:20:09.001Z\",\"agent\":{\"ephemeral_id\":\"9e8b3684-f98e-4660-a5f0-b9055e0435e9\",\"id\":\"60a0a7eb-8adf-44b2-8571-636680a0f5cd\",\"name\":\"NORDC-APP-FS01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T13:20:09.148Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-FS01.oscorp.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint 12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72 is about to expire or already expired.\",\"organization\":\"oscorp\",\"senderHost\":\"nordc-app-fs01.oscorp.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-FS01.oscorp.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":1284646,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "nordc-app-fs01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "1284646"
}