WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.oscorp.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72 is about to expire or already expired.","organization":"oscorp","senderHost":"nordc-app-fs01.oscorp.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.oscorp.com","event_data":{"Context":"local system","ObjId":"12 e3 54 3c 58 7f c1 7f 0d f3 06 c9 37 1e 19 7e fa c1 3e 72"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284646,"task":"None"}}
This is a syslog message from a product called microsoft-windows-certificateservicesclient-autoenrollment by microsoft-windows-certificateservicesclient-autoenrollment. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 64
senderHost: nordc-app-fs01.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-certificateservicesclient-autoenrollment
tags: ['v8', 'eventId:64', 'microsoft-windows-certificateservicesclient-autoenrollment', '64']
vendorCode: 1284646