WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T16:57:16.767Z","agent":{"ephemeral_id":"299490b0-df7b-4ea3-852c-b13bf7b326be","id":"45d3a14b-b7f4-4946-9eb9-604d11193cb6","name":"NORDC-SS1-FS19","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"DnsRegistration","code":"8012","created":"2024-07-26T16:57:18.051Z","kind":"event","provider":"Microsoft-Windows-DNS-Client"},"host":{"name":"NORDC-SS1-FS19.acme.com"},"log":{"level":"information"},"message":"The system failed to register pointer (PTR) resource records (RRs) for network adapter\nwith settings:\n\n           Adapter Name : {778776FA-FB4A-4A55-A01B-E4AE90D1A3D4}\n           Host Name : NORDC-SS1-FS19\n           Adapter-specific Domain Suffix : acme.com\n           DNS server list :\n             \t192.168.10.14, 192.168.10.46\n           Sent update to server : 192.168.10.14:53\n           IP Address :\n             192.168.14.92\n\nThe reason that the system could not register these RRs was because the DNS server refused the update request. The cause of this could be (a) your computer is not allowed to update the adapter-specified DNS domain name, or (b) because the DNS server authoritative for the specified name does not support the DNS dynamic update protocol.\n\nTo register the DNS pointer (PTR) resource records using the specific DNS domain name and IP addresses for this adapter, contact your DNS server or network systems administrator.","organization":"acme","senderHost":"p10vm02.acme.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"System","computer_name":"NORDC-SS1-FS19.acme.com","event_data":{"AdapterName":"{778776FA-FB4A-4A55-A01B-E4AE90D1A3D4}","AdapterSuffixName":"acme.com","DnsServerList":"\t192.168.10.14, 192.168.10.46","ErrorCode":"9005","HostName":"NORDC-SS1-FS19","Ipaddress":"192.168.14.92","Sent UpdateServer":"192.168.10.14:53"},"event_id":"8012","opcode":"Info","process":{"pid":1292,"thread":{"id":4484}},"provider_guid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","provider_name":"Microsoft-Windows-DNS-Client","record_id":69525,"task":"DnsRegistration","user":{"domain":"NT AUTHORITY","identifier":"S-1-5-20","name":"NETWORK SERVICE","type":"Well Known Group"}}}
This is a syslog message from a product called microsoft-windows-dns-client by microsoft-windows-dns-client. The following fields were extracted from the message:
action: DnsRegistration
fieldExtractorName: winlogbeat
messageType: 8012
senderHost: p10vm02.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-dns-client
tags: ['v8', 'eventId:8012', 'microsoft-windows-dns-client', '8012']
vendorCode: 69525