WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.acme.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 66 91 d6 d5 ea 7c 49 01 50 fc 9f 7d 7f f8 b1 fc 28 2d 3c d0 is about to expire or already expired.","organization":"acme","senderHost":"nordc-app-fs01.acme.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.acme.com","event_data":{"Context":"local system","ObjId":"66 91 d6 d5 ea 7c 49 01 50 fc 9f 7d 7f f8 b1 fc 28 2d 3c d0"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284643,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:20:09.001Z\",\"agent\":{\"ephemeral_id\":\"9e8b3684-f98e-4660-a5f0-b9055e0435e9\",\"id\":\"60a0a7eb-8adf-44b2-8571-636680a0f5cd\",\"name\":\"NORDC-APP-FS01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T13:20:09.148Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-FS01.acme.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint 66 91 d6 d5 ea 7c 49 01 50 fc 9f 7d 7f f8 b1 fc 28 2d 3c d0 is about to expire or already expired.\",\"organization\":\"acme\",\"senderHost\":\"nordc-app-fs01.acme.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-FS01.acme.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"66 91 d6 d5 ea 7c 49 01 50 fc 9f 7d 7f f8 b1 fc 28 2d 3c d0\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":1284643,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "nordc-app-fs01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "1284643"
}