WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T17:07:11.337Z","agent":{"ephemeral_id":"e8fb59cc-e149-43a7-ab4b-53ab61624426","id":"68d26628-116d-42f1-a6e0-d53dfced01df","name":"NORDC-APP-LATz1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T17:07:11.964Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-LATz1.stark.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb is about to expire or already expired.","organization":"stark","senderHost":"192.168.12.141","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-LATz1.stark.com","event_data":{"Context":"local system","ObjId":"76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":182140,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T17:07:11.337Z\",\"agent\":{\"ephemeral_id\":\"e8fb59cc-e149-43a7-ab4b-53ab61624426\",\"id\":\"68d26628-116d-42f1-a6e0-d53dfced01df\",\"name\":\"NORDC-APP-LATz1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T17:07:11.964Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-LATz1.stark.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint 76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb is about to expire or already expired.\",\"organization\":\"stark\",\"senderHost\":\"192.168.12.141\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-LATz1.stark.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":182140,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "192.168.12.141",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "182140"
}