WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=72.54.240.205 ::: message={"access_device":{"epkey":"EPRAWJILJ9GS1FBKUCRU","hostname":null,"ip":"72.54.240.205","location":{"city":"Marietta","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"72.54.240.205","key":"DPQZQ0A0QG2UTZDWZH7B","location":{"city":"Marietta","country":"United States","state":"Georgia"},"name":"678-471-4361"},"email":"sstewart@oscorpelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-04-05T18:40:08.237611+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1680720008,"txid":"a878cf6c-4085-479a-8c2f-be8f3b4d466d","user":{"groups":[],"key":"DUH9YK2ESG8SJ0V85X35","name":"alice"}} ::: clientIP=72.54.240.205 ::: userName=alice ::: created_at=1680720008 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1680720008 ::: clientHostname=678-471-4361 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1680720008
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 98.62.136.130
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: 678-471-4361
streamName: DUO
clientIP: 72.54.240.205
userName: alice