WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T17:13:24.800Z","agent":{"ephemeral_id":"260ede45-055c-4971-bf37-326b2746e6e0","id":"e1107597-7f54-462a-9b3b-bb9b84ed48be","name":"DC-STG-STSSQL01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"1003","created":"2024-07-26T17:13:25.628Z","kind":"event","provider":"Microsoft-Windows-Security-SPP"},"host":{"name":"DC-STG-STSSQL01.stark.com"},"log":{"level":"information"},"message":"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 22105925-48c3-4ff4-a294-f654bb27e390, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 281c216a-5957-439b-adf2-aff4098a2bdd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 4285bbda-6219-4c1a-98e9-859e60d669fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 44a5b4c3-e4b1-483b-81e8-0f78f4d98283, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 661f7658-7035-4b4c-9f35-010682943ec2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 8ea56c31-fe6e-4d56-9d17-8dc1ab35dd8b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 92114319-12ea-4bca-9d63-8740de9feff3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: c2d23e1f-ee3e-4533-9094-e6dc0b8aa049, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: d07edbd8-02cb-49b1-8358-f2de7afd8a4d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: de32eafd-aaee-4662-9444-c1befb41bde2, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n14: e73aabfa-12bc-4705-b551-2dd076bebc7d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: e936f630-5125-4a39-b1de-544d6c036491, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: fd946594-6f0d-4c5c-9bf7-f5f628ecd0b9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]","organization":"stark","senderHost":"DC-STG-STSSQL01.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"DC-STG-STSSQL01.stark.com","event_data":{"param1":"55c92734-d682-4d71-983e-d6ec3f16059f","param2":"\n1: 22105925-48c3-4ff4-a294-f654bb27e390, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 281c216a-5957-439b-adf2-aff4098a2bdd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 4285bbda-6219-4c1a-98e9-859e60d669fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 44a5b4c3-e4b1-483b-81e8-0f78f4d98283, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 661f7658-7035-4b4c-9f35-010682943ec2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 8ea56c31-fe6e-4d56-9d17-8dc1ab35dd8b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 92114319-12ea-4bca-9d63-8740de9feff3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: c2d23e1f-ee3e-4533-9094-e6dc0b8aa049, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: d07edbd8-02cb-49b1-8358-f2de7afd8a4d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: de32eafd-aaee-4662-9444-c1befb41bde2, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n14: e73aabfa-12bc-4705-b551-2dd076bebc7d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: e936f630-5125-4a39-b1de-544d6c036491, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: fd946594-6f0d-4c5c-9bf7-f5f628ecd0b9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]"},"event_id":"1003","keywords":["Classic"],"opcode":"Info","provider_guid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","provider_name":"Microsoft-Windows-Security-SPP","record_id":95218,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T17:13:24.800Z\",\"agent\":{\"ephemeral_id\":\"260ede45-055c-4971-bf37-326b2746e6e0\",\"id\":\"e1107597-7f54-462a-9b3b-bb9b84ed48be\",\"name\":\"DC-STG-STSSQL01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"1003\",\"created\":\"2024-07-26T17:13:25.628Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-Security-SPP\"},\"host\":{\"name\":\"DC-STG-STSSQL01.stark.com\"},\"log\":{\"level\":\"information\"},\"message\":\"The Software Protection service has completed licensing status check.\\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\\nLicensing Status=\\n1: 22105925-48c3-4ff4-a294-f654bb27e390, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n2: 281c216a-5957-439b-adf2-aff4098a2bdd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n3: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n4: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n5: 4285bbda-6219-4c1a-98e9-859e60d669fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n6: 44a5b4c3-e4b1-483b-81e8-0f78f4d98283, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n7: 661f7658-7035-4b4c-9f35-010682943ec2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n8: 8ea56c31-fe6e-4d56-9d17-8dc1ab35dd8b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n9: 92114319-12ea-4bca-9d63-8740de9feff3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n10: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n11: c2d23e1f-ee3e-4533-9094-e6dc0b8aa049, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n12: d07edbd8-02cb-49b1-8358-f2de7afd8a4d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n13: de32eafd-aaee-4662-9444-c1befb41bde2, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\\n14: e73aabfa-12bc-4705-b551-2dd076bebc7d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n15: e936f630-5125-4a39-b1de-544d6c036491, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n16: fd946594-6f0d-4c5c-9bf7-f5f628ecd0b9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\",\"organization\":\"stark\",\"senderHost\":\"DC-STG-STSSQL01.stark.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"DC-STG-STSSQL01.stark.com\",\"event_data\":{\"param1\":\"55c92734-d682-4d71-983e-d6ec3f16059f\",\"param2\":\"\\n1: 22105925-48c3-4ff4-a294-f654bb27e390, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n2: 281c216a-5957-439b-adf2-aff4098a2bdd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n3: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n4: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n5: 4285bbda-6219-4c1a-98e9-859e60d669fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n6: 44a5b4c3-e4b1-483b-81e8-0f78f4d98283, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n7: 661f7658-7035-4b4c-9f35-010682943ec2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n8: 8ea56c31-fe6e-4d56-9d17-8dc1ab35dd8b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n9: 92114319-12ea-4bca-9d63-8740de9feff3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n10: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n11: c2d23e1f-ee3e-4533-9094-e6dc0b8aa049, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n12: d07edbd8-02cb-49b1-8358-f2de7afd8a4d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n13: de32eafd-aaee-4662-9444-c1befb41bde2, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\\n14: e73aabfa-12bc-4705-b551-2dd076bebc7d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n15: e936f630-5125-4a39-b1de-544d6c036491, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\\n16: fd946594-6f0d-4c5c-9bf7-f5f628ecd0b9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\"},\"event_id\":\"1003\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"provider_name\":\"Microsoft-Windows-Security-SPP\",\"record_id\":95218,\"task\":\"None\"}}",
    "messageType": "1003",
    "senderHost": "DC-STG-STSSQL01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-security-spp",
    "tags": [
        "v8",
        "eventId:1003",
        "microsoft-windows-security-spp",
        "1003"
    ],
    "vendorCode": "95218"
}