WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T11:09:53.062Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"299","created":"2024-07-26T11:09:53.643Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.wayne.com"},"log":{"level":"information"},"message":"A token was successfully issued for the relying party 'urn:federation:MicrosoftOnline'.  See audit 500 with the same Instance ID for issued claims.  See audit 501 with the same Instance ID for caller identity. See audit 502 with the same Instance ID for OnBehalfOf identity, if any. See audit 503 with the same Instance ID for ActAs identity, if any. \n\nInstance ID: 209d202e-59c5-40e8-9af7-21b1e5cd253e \n\nActivity ID: aa9383a6-07da-4db3-81b8-5e031340b150 \n\nRelying party: urn:federation:MicrosoftOnline","organization":"wayne","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.wayne.com","event_data":{"param1":"209d202e-59c5-40e8-9af7-21b1e5cd253e","param2":"aa9383a6-07da-4db3-81b8-5e031340b150","param3":"urn:federation:MicrosoftOnline"},"event_id":"299","keywords":["Audit Success","Classic"],"opcode":"Info","provider_name":"AD FS Auditing","record_id":1387968703,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T11:09:53.062Z\",\"agent\":{\"ephemeral_id\":\"2684bcd2-4a2b-4981-9139-d620c6b2af92\",\"id\":\"a5def5dd-6173-4dfd-bc91-3ca20122db53\",\"name\":\"Nordc-APP-ADFS1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"299\",\"created\":\"2024-07-26T11:09:53.643Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"AD FS Auditing\"},\"host\":{\"name\":\"Nordc-APP-ADFS1.wayne.com\"},\"log\":{\"level\":\"information\"},\"message\":\"A token was successfully issued for the relying party 'urn:federation:MicrosoftOnline'.  See audit 500 with the same Instance ID for issued claims.  See audit 501 with the same Instance ID for caller identity. See audit 502 with the same Instance ID for OnBehalfOf identity, if any. See audit 503 with the same Instance ID for ActAs identity, if any. \\n\\nInstance ID: 209d202e-59c5-40e8-9af7-21b1e5cd253e \\n\\nActivity ID: aa9383a6-07da-4db3-81b8-5e031340b150 \\n\\nRelying party: urn:federation:MicrosoftOnline\",\"organization\":\"wayne\",\"senderHost\":\"192.168.10.55\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Nordc-APP-ADFS1.wayne.com\",\"event_data\":{\"param1\":\"209d202e-59c5-40e8-9af7-21b1e5cd253e\",\"param2\":\"aa9383a6-07da-4db3-81b8-5e031340b150\",\"param3\":\"urn:federation:MicrosoftOnline\"},\"event_id\":\"299\",\"keywords\":[\"Audit Success\",\"Classic\"],\"opcode\":\"Info\",\"provider_name\":\"AD FS Auditing\",\"record_id\":1387968703,\"user\":{\"domain\":\"MDS-ATL\",\"identifier\":\"S-1-5-21-1725571127-999974082-2044928816-27902\",\"name\":\"adfs\",\"type\":\"User\"}}}",
    "messageType": "299",
    "senderHost": "192.168.10.55",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "ad fs auditing",
    "tags": [
        "v8",
        "eventId:299",
        "ad fs auditing",
        "299"
    ],
    "vendorCode": "1387968703"
}