WitFoo-Artifact ::: messageType=asset_inventory ::: streamName=DUO Asset Inventory ::: message={"alias1":null,"alias2":null,"alias3":null,"alias4":null,"aliases":{},"created":1671055351,"desktoptokens":[],"email":"janedoe","enable_auto_prompt":true,"external_id":"7hSBENHI7UiTN++DrebtAw==","firstname":"","groups":[{"desc":"","group_id":"DG4OA9OC4WS33G54DD2O","mobile_otp_enabled":false,"name":"DuoUsers (from AD sync \"AD Sync\")","push_enabled":false,"sms_enabled":false,"status":"Active","voice_enabled":false}],"is_enrolled":true,"last_directory_sync":1722031562,"last_login":1721994345,"lastname":"","lockout_reason":null,"notes":"New hire.  01/12/2023\r\nLeon","phones":[{"activated":true,"capabilities":["auto","push","sms","phone","mobile_otp"],"encrypted":"Encrypted","extension":"","fingerprint":"Configured","last_seen":"2024-07-26T11:44:54","model":"Apple iPhone 13 Pro Max","name":"","number":"+14783186929","phone_id":"DPXKZ59E1Y6NX88LO7QL","platform":"Apple iOS","postdelay":"","predelay":"","screenlock":"Locked","sms_passcodes_sent":false,"tampered":"Not tampered","type":"Mobile"}],"realname":"Harrison Millines Jr","status":"active","tokens":[],"u2ftokens":[],"user_id":"DUGF8X19LNGI457T1E0R","username":"harrison.millines","webauthncredentials":[]} ::: program=cisco_duo ::: userName=janedoe
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['DUO Asset Inventory', 'asset_inventory']
userName: janedoe