<110>2024-07-26T23:55:04.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ADFSReports ]  [ REPORT_PROFILE = Logon Success ]  [ USERNAME = rpa03 ]  [ CLIENT_MC_NAME = - ]  [ CLIENT_HOST_NAME = null ]  [ TIME_GENERATED = 1722052504 ]  [ RECORD_NUMBER = 1388369645 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ DOMAIN = acme.com ]  [ SOURCE = NORDC-APP-ADFS1 ]  [ USER_SID = %{S-1-5-21-1725571127-999974082-2044928816-27902} ]  [ EVENT_NUMBER = 1202 ]  [ REMARKS = The Federation Service validated a new credential. See XML for details. ]  [ LOGON_ID = - ]  [ LOGON_TYPE = - ]  [ LOGON_TYPE_TEXT = - ]  [ LOGON_PROCESS = - ]  [ AUTHENTICATION_PACKAGE = - ]  [ CALLER_USER_NAME = - ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ SOURCE_PORT = - ]  [ FORMAT_MESSAGE = null ]  [ CALLER_PROCESS_ID = - ]  [ CALLER_PROCESS_NAME = - ]  [ IMPERSONATION_LEVEL = - ]  [ RELYING_PARTY = urn:federation:MicrosoftOnline ]  [ TOKEN_TYPE = null ]  [ INSIDE_CORPORATE_NETWORK = True ]  [ IP_ADDRESS = 192.168.14.35 ]  [ ISSUED_CLAIMS = null ]  [ CALLER_IDENTITY = <?xml version="1.0" encoding="utf-16"?><AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit">  <AuditType>AppToken</AuditType>  <AuditResult>Success</AuditResult>  <FailureType>None</FailureType>  <ErrorCode>N/A</ErrorCode>  <ContextComponents>    <Component xsi:type="ResourceAuditComponent">      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>      <UserId>MDS-ATL\rpa03</UserId>    </Component>    <Component xsi:type="AuthNAuditComponent">      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>      <DeviceAuth>false</DeviceAuth>      <DeviceId>N/A</DeviceId>      <MfaPerformed>false</MfaPerformed>      <MfaMethod>N/A</MfaMethod>      <TokenBindingProvidedId>false</TokenBindingProvidedId>      <TokenBindingReferredId>false</TokenBindingReferredId>      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>    </Component>    <Component xsi:type="ProtocolAuditComponent">      <OAuthClientId>N/A</OAuthClientId>      <OAuthGrant>N/A</OAuthGrant>    </Component>    <Component xsi:type="RequestAuditComponent">      <Server>http://adfs.acme.com/adfs/services/trust</Server>      <AuthProtocol>N/A</AuthProtocol>      <NetworkLocation>Intranet</NetworkLocation>      <IpAddress>192.168.14.35</IpAddress>      <ForwardedIpAddress />      <ProxyIpAddress>N/A</ProxyIpAddress>      <NetworkIpAddress>N/A</NetworkIpAddress>      <ProxyServer>N/A</ProxyServer>      <UserAgentString>Windows-AzureAD-Authentication-Provider/1.0</UserAgentString>      <Endpoint>/adfs/services/trust/13/usernamemixed</Endpoint>    </Component>  </ContextComponents></AuditBase> ]  [ HOST_NAME = null ]  [ ERROR_CODE = - ]  [ ERROR_CODE_TEXT = - ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = null ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = null ]  [ USER_NAME_OU_GUID = null ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ CALLER_LOGON_ID = null ]  [ FAILURE_STATUS = null ]  [ FAILURE_SUB_STATUS = null ]  [ KEY_LENGTH = null ]  [ NTLM_PACKAGE_NAME = null ]  [ TRANSITED_SERVICES = null ]  [ WORKSTATION_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = null ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = null ]  [ CALLER_USER_OU_GUID = null ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ CLIENT_HOST_DOMAIN_NAME = null ]  [ IS_MFA_PERFORMED = false ]  [ PROXY_NAME = N/A ]  [ PROTOCOL_NAME = null ]  [ ENDPOINT_NAME = null ]  [ USER_AGENT_NAME = null ]  [ MFA_DEVICE_ID = null ]  [ MFA_DEVICE_AUTHENTICATION = null ]  [ MFA_METHOD = null ]  [ CORRELATION_ID = - ]  [ BAD_PASSWORD_COUNT = null ]  [ LAST_BAD_PASSWORD_ATTEMPT = - ]  [ LOCKOUT_WINDOW = - ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ] 
This is a syslog message from a product called ManageEngine ADManager by ManageEngine. The following fields were extracted from the message:
facilityCode: 13
facilityLabel: log audit
fieldExtractorName: ad_audit_plus
localHostname: Nordc-app-Dell
localStartTime: 2024-07-26T23:55:04.000-04:00
messageType: audit_log
priority: 110
program: ADAuditPlus
senderHost: 192.168.10.233
sensitivity: normal
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: ad_audit_plus
tags: ['rfc3164', 'ad_audit_plus', 'audit_log']