WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-30T10:14:40.387Z","agent":{"ephemeral_id":"a668c636-ec70-4103-9c98-53517f0df854","id":"040c78f0-1741-4108-a30c-aaf00e9af961","name":"NVIPROCPRDWEB01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"4624","created":"2024-07-30T10:14:42.297Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"NVIPROCPRDWEB01.prdnvi.starkint.com"},"log":{"level":"information"},"message":"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tNVIPROCPRDWEB01$\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t4\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-855572474-1402847513-2951438033-32165\n\tAccount Name:\t\tprocprd-appuser\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x1C5B86AA\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{cbf3a394-d4ce-9622-1544-923035733fe4}\n\nProcess Information:\n\tProcess ID:\t\t0xb08\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tNVIPROCPRDWEB01\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","organization":"stark","senderHost":"10.160.18.44","sensitivity":"normal","winlog":{"activity_id":"{72e70134-d9a9-0000-db01-e772a9d9da01}","api":"wineventlog","channel":"Security","computer_name":"NVIPROCPRDWEB01.prdnvi.starkint.com","event_data":{"AuthenticationPackageName":"Negotiate","ElevatedToken":"%%1842","ImpersonationLevel":"%%1833","IpAddress":"-","IpPort":"-","KeyLength":"0","LmPackageName":"-","LogonGuid":"{cbf3a394-d4ce-9622-1544-923035733fe4}","LogonProcessName":"Advapi  ","LogonType":"4","ProcessId":"0xb08","ProcessName":"C:\\Windows\\System32\\svchost.exe","RestrictedAdminMode":"-","SubjectDomainName":"prdnvi","SubjectLogonId":"0x3e7","SubjectUserName":"NVIPROCPRDWEB01$","SubjectUserSid":"S-1-5-18","TargetDomainName":"prdnvi","TargetLinkedLogonId":"0x0","TargetLogonId":"0x1c5b86aa","TargetOutboundDomainName":"-","TargetOutboundUserName":"-","TargetUserName":"procprd-appuser","TargetUserSid":"S-1-5-21-855572474-1402847513-2951438033-32165","TransmittedServices":"-","VirtualAccount":"%%1843","WorkstationName":"NVIPROCPRDWEB01"},"event_id":"4624","keywords":["Audit Success"],"opcode":"Info","process":{"pid":652,"thread":{"id":1116}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":6493971,"task":"Logon","version":2}}
{
    "fieldExtractorName": "symantec_dlp",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-30T10:14:40.387Z\",\"agent\":{\"ephemeral_id\":\"a668c636-ec70-4103-9c98-53517f0df854\",\"id\":\"040c78f0-1741-4108-a30c-aaf00e9af961\",\"name\":\"NVIPROCPRDWEB01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Logon\",\"code\":\"4624\",\"created\":\"2024-07-30T10:14:42.297Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"NVIPROCPRDWEB01.prdnvi.starkint.com\"},\"log\":{\"level\":\"information\"},\"message\":\"An account was successfully logged on.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tNVIPROCPRDWEB01$\\n\\tAccount Domain:\\t\\tprdnvi\\n\\tLogon ID:\\t\\t0x3E7\\n\\nLogon Information:\\n\\tLogon Type:\\t\\t4\\n\\tRestricted Admin Mode:\\t-\\n\\tVirtual Account:\\t\\tNo\\n\\tElevated Token:\\t\\tYes\\n\\nImpersonation Level:\\t\\tImpersonation\\n\\nNew Logon:\\n\\tSecurity ID:\\t\\tS-1-5-21-855572474-1402847513-2951438033-32165\\n\\tAccount Name:\\t\\tprocprd-appuser\\n\\tAccount Domain:\\t\\tprdnvi\\n\\tLogon ID:\\t\\t0x1C5B86AA\\n\\tLinked Logon ID:\\t\\t0x0\\n\\tNetwork Account Name:\\t-\\n\\tNetwork Account Domain:\\t-\\n\\tLogon GUID:\\t\\t{cbf3a394-d4ce-9622-1544-923035733fe4}\\n\\nProcess Information:\\n\\tProcess ID:\\t\\t0xb08\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\n\\nNetwork Information:\\n\\tWorkstation Name:\\tNVIPROCPRDWEB01\\n\\tSource Network Address:\\t-\\n\\tSource Port:\\t\\t-\\n\\nDetailed Authentication Information:\\n\\tLogon Process:\\t\\tAdvapi  \\n\\tAuthentication Package:\\tNegotiate\\n\\tTransited Services:\\t-\\n\\tPackage Name (NTLM only):\\t-\\n\\tKey Length:\\t\\t0\\n\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\n\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\n\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\n\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\n\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\n\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\n\\nThe authentication information fields provide detailed information about this specific logon request.\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\",\"organization\":\"stark\",\"senderHost\":\"10.160.18.44\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{72e70134-d9a9-0000-db01-e772a9d9da01}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"NVIPROCPRDWEB01.prdnvi.starkint.com\",\"event_data\":{\"AuthenticationPackageName\":\"Negotiate\",\"ElevatedToken\":\"%%1842\",\"ImpersonationLevel\":\"%%1833\",\"IpAddress\":\"-\",\"IpPort\":\"-\",\"KeyLength\":\"0\",\"LmPackageName\":\"-\",\"LogonGuid\":\"{cbf3a394-d4ce-9622-1544-923035733fe4}\",\"LogonProcessName\":\"Advapi  \",\"LogonType\":\"4\",\"ProcessId\":\"0xb08\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"RestrictedAdminMode\":\"-\",\"SubjectDomainName\":\"prdnvi\",\"SubjectLogonId\":\"0x3e7\",\"SubjectUserName\":\"NVIPROCPRDWEB01$\",\"SubjectUserSid\":\"S-1-5-18\",\"TargetDomainName\":\"prdnvi\",\"TargetLinkedLogonId\":\"0x0\",\"TargetLogonId\":\"0x1c5b86aa\",\"TargetOutboundDomainName\":\"-\",\"TargetOutboundUserName\":\"-\",\"TargetUserName\":\"procprd-appuser\",\"TargetUserSid\":\"S-1-5-21-855572474-1402847513-2951438033-32165\",\"TransmittedServices\":\"-\",\"VirtualAccount\":\"%%1843\",\"WorkstationName\":\"NVIPROCPRDWEB01\"},\"event_id\":\"4624\",\"keywords\":[\"Audit Success\"],\"opcode\":\"Info\",\"process\":{\"pid\":652,\"thread\":{\"id\":1116}},\"provider_guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":6493971,\"task\":\"Logon\",\"version\":2}}",
    "messageType": "data_loss",
    "productIds": [
        44
    ],
    "senderHost": "10.160.18.44",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "symantec_dlp",
    "tags": [
        "symantec_dlp",
        "data_loss"
    ]
}