WitFoo-Artifact ::: messageType=auth_success ::: userName=fish ::: program=cisco_duo ::: streamName=DUO Asset Inventory ::: tags=[remembered_device] ::: message={"access_device":{"browser":"Chrome","browser_version":"126.0.6478.185","epkey":"EPOZHVQKMVG7C0MWPTMC","flash_version":"uninstalled","hostname":null,"ip":"69.234.139.26","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Powder Springs","country":"United States","state":"Georgia"},"os":"Windows","os_version":"11"},"adaptive_trust_assessments":{"more_secure_auth":{"detected_attack_detectors":null,"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"preview_mode_enabled":false,"reason":"Normal level of trust; no detection of known attack pattern","trust_level":"NORMAL"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Known Access IP","trust_level":"NORMAL"}},"alias":"","application":{"key":"DIXDMKE23EM9ZNM3D8S1","name":"MingApps Production (Duo SSO)"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":"fish","event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T11:46:54.626614+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","remembered_factor":"duo_push","result":"success","timestamp":1721994414,"trusted_endpoint_status":"unknown","txid":"bdbba11f-ccba-4911-9419-115cf21af74b","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DUWX1F4FKTG4ABN9E4QM","name":"jfern"}}
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: auth_success
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['remembered_device', 'DUO Asset Inventory', 'auth_success']
userName: fish