WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T00:55:18.451Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"1202","created":"2024-07-27T00:55:18.796Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.acme.com"},"log":{"level":"information"},"message":"The Federation Service validated a new credential. See XML for details. \n\nActivity ID: 55ccdd75-a139-4da2-9b2b-6499b4bc3ed0 \n\nAdditional Data \nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\n  <AuditType>FreshCredentials</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>N/A</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\rpa01</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>N/A</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.acme.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>192.168.14.35</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>UiPath.MicrosoftOffice365/1.11.1.0</UserAgentString>\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>","organization":"acme","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.acme.com","event_data":{"param1":"55ccdd75-a139-4da2-9b2b-6499b4bc3ed0","param2":"<?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\n  <AuditType>FreshCredentials</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>N/A</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\rpa01</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>N/A</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.acme.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>192.168.14.35</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>UiPath.MicrosoftOffice365/1.11.1.0</UserAgentString>\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>"},"event_id":"1202","keywords":["Audit Success","Classic"],"provider_name":"AD FS Auditing","record_id":1388328643,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
This is a syslog message from a product called ad fs auditing by ad fs auditing. The following fields were extracted from the message:
fieldExtractorName: winlogbeat
messageType: 1202
senderHost: 192.168.10.55
sensitivity: normal
sourceInfo: unknown
streamName: ad fs auditing
tags: ['v8', 'eventId:1202', 'ad fs auditing', '1202']
vendorCode: 1388328643