WitFoo-Artifact ::: tags=["description=Authenticate user with AD agent","userDisplay=undefined | undefined","reason=WitFoo.Switch(FAILURE)"] ::: action=FAILURE ::: message={"user":{"id":"00u176suj2KgPRj9K697","status":"ACTIVE","created":"2022-05-27T15:49:21.000Z","activated":"2022-05-27T15:49:22.000Z","statusChanged":"2023-05-03T17:47:47.000Z","lastLogin":"2023-05-18T17:12:00.000Z","lastUpdated":"2023-05-18T23:25:08.000Z","passwordChanged":"2023-05-03T17:47:47.000Z","type":{"id":"oty16ygr7f2XinpEr697"},"profile":{"firstName":"IT","lastName":"Support","mobilePhone":null,"secondEmail":"","login":"johndoe","email":"johndoe"},"credentials":{"password":{},"provider":{"type":"OKTA","name":"OKTA"}},"_links":{"suspend":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/lifecycle/suspend","method":"POST"},"schema":{"href":"https://oscorp.okta.com/api/v1/meta/schemas/user/osc16ygr7f2XinpEr697"},"resetPassword":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/lifecycle/reset_password","method":"POST"},"forgotPassword":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/credentials/forgot_password","method":"POST"},"expirePassword":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/lifecycle/expire_password","method":"POST"},"changeRecoveryQuestion":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/credentials/change_recovery_question","method":"POST"},"self":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697"},"resetFactors":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/lifecycle/reset_factors","method":"POST"},"type":{"href":"https://oscorp.okta.com/api/v1/meta/types/user/oty16ygr7f2XinpEr697"},"changePassword":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/credentials/change_password","method":"POST"},"deactivate":{"href":"https://oscorp.okta.com/api/v1/users/00u176suj2KgPRj9K697/lifecycle/deactivate","method":"POST"}}},"event":{"actor":{"id":"00u176suj2KgPRj9K697","type":"User","alternateId":"johndoe","displayName":"IT Support","detailEntry":null},"client":{"userAgent":{"rawUserAgent":"Okta AD Agent/3.16.0 (Microsoft Windows NT 6.2.9200.0; .NET CLR 4.0.30319.42000; 64-bit OS; 64-bit Process; sslpinning=disabled)","os":"Windows 8","browser":"UNKNOWN"},"zone":"null","device":"Computer","id":"cappT0Hfy97F1BoO1UTR","ipAddress":"106.98.126.88","geographicalContext":{"city":"Scottsdale","state":"Arizona","country":"United States","postalCode":"85254","geolocation":{"lat":33.6194,"lon":-111.9556}}},"device":null,"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","credentialProvider":null,"credentialType":"PASSWORD","issuer":null,"interface":null,"authenticationStep":0,"externalSessionId":"trsByhaktjTQtmLtUV4DNEUCQ"},"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","outcome":{"result":"FAILURE","reason":"Login Failed"},"published":"2023-10-19T13:55:24.180Z","securityContext":{"asNumber":3549,"asOrg":"level 3 parent  llc","isp":"level 3 parent  llc","domain":"ctl.one","isProxy":false},"severity":"ERROR","debugContext":{"debugData":{"requestId":"ZTE1TLlXTsFmkAl7l5Ag4OSCORPA7E","dtHash":"4aac8811b9ac79c6523518f111da1e6c70883fb115e00ad5a1750e1a3eee59ae","requestUri":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a53173qznyfOdAONy697/actionResult","url":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a53173qznyfOdAONy697/actionResult?responseId=619f2d94-318d-4dda-ac50-541d9b395f93"}},"legacyEventType":"app.ad.agent.user_auth.error","transaction":{"type":"WEB","id":"ZTE1TLlXTsFmkAl7l5Ag4OSCORPA7E","detail":{"requestApiTokenId":"00T4inn7xxrmTLuOw696"}},"uuid":"2691e636-6e87-11ee-bec9-b58276c13f71","version":"0","request":{"ipChain":[{"ip":"106.98.126.88","geographicalContext":{"city":"Scottsdale","state":"Arizona","country":"United States","postalCode":"85254","geolocation":{"lat":33.6194,"lon":-111.9556}},"version":"V4","source":null}]},"target":[{"id":"0oa16yxhp6iUzuI2b697","type":"AppInstance","alternateId":"SDPB.LOCAL","displayName":"Active Directory","detailEntry":null}]}} ::: program=UNKNOWN ::: clientIP=106.98.126.88 ::: userName=johndoe ::: geoRegion=United States ::: created_at=2023-10-19T13:55:24.180Z ::: streamName=Okta ::: vendorCode=user.authentication.auth_via_AD_agent ::: messageType=auth_failure ::: pipelineName=Okta ::: severityCode=2 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Okta by Okta. The following fields were extracted from the message:
action: FAILURE
georegion: United States
messagetype: auth_failure
productids: [6]
program: UNKNOWN
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
tags: ['userDisplay=undefined | undefined', 'reason=WitFoo.Switch(FAILURE)', 'Okta', 'description=Authenticate user with AD agent', 'auth_failure']
vendorcode: user.authentication.auth_via_AD_agent
streamName: Okta
clientIP: 106.98.126.88
userName: johndoe