WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=105.226.12.25 ::: message={"access_device":{"epkey":"EP35H33237T7ULBSR2Y7","hostname":null,"ip":"105.226.12.25","location":{"city":"Flowery Branch","country":"United States","state":"Georgia"}},"alias":"bob@acmeutilities.com","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"105.226.12.25","key":"DPAUBRPAZV20E11AL2FW","location":{"city":"Flowery Branch","country":"United States","state":"Georgia"},"name":"478-256-0857"},"email":"bob@acmeutilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-08-30T22:10:59.804868+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1693433459,"trusted_endpoint_status":"unknown","txid":"9d54d395-777a-48a1-ad4f-e37d01acccf7","user":{"groups":[],"key":"DUT0KKQOH0R1FTLFGDXI","name":"bob"}} ::: clientIP=105.226.12.25 ::: userName=bob ::: created_at=1693433459 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1693433459 ::: clientHostname=478-256-0857 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 478-256-0857
localip: 45.25.43.139
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1693433459
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 105.226.12.25
userName: bob