WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2023-10-08T13:48:57.438Z","agent":{"ephemeral_id":"607a1fdf-6cfe-42df-b69a-dbe7dda38867","id":"35b748e2-76e2-46e4-ae7e-577371125919","name":"xapp4","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"4625","created":"2023-10-08T13:48:57.811Z","kind":"event","outcome":"failure","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"xapp4.umbrella.org"},"log":{"level":"information"},"message":"An account failed to log on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tXAPP4$\n\tAccount Domain:\t\tUMBRELLA\n\tLogon ID:\t\t0x3E7\n\nLogon Type:\t\t\t10\n\nAccount For Which Logon Failed:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tnighthawk\n\tAccount Domain:\t\tumbrella.org\n\nFailure Information:\n\tFailure Reason:\t\tUnknown user name or bad password.\n\tStatus:\t\t\t0xC000006D\n\tSub Status:\t\t0xC000006A\n\nProcess Information:\n\tCaller Process ID:\t0xcec\n\tCaller Process Name:\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tXAPP4\n\tSource Network Address:\t123.45.3.248\n\tSource Port:\t\t50348\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\n\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\n\nThe Process Information fields indicate which account and process on the system requested the logon.\n\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","organization":"umbrella","senderHost":"xapp4.umbrella.org","sensitivity":"normal","winlog":{"activity_id":"{bbeb95b0-ee21-4f3a-b02b-c36f62e0de2e}","api":"wineventlog","channel":"Security","computer_name":"xapp4.umbrella.org","event_data":{"AuthenticationPackageName":"Negotiate","FailureReason":"%%2313","IpAddress":"123.45.3.248","IpPort":"50348","KeyLength":"0","LmPackageName":"-","LogonProcessName":"User32 ","LogonType":"10","ProcessId":"0xcec","ProcessName":"C:\\Windows\\System32\\svchost.exe","Status":"0xc000006d","SubStatus":"0xc000006a","SubjectDomainName":"UMBRELLA","SubjectLogonId":"0x3e7","SubjectUserName":"XAPP4$","SubjectUserSid":"S-1-5-18","TargetDomainName":"umbrella.org","TargetUserName":"nighthawk","TargetUserSid":"S-1-0-0","TransmittedServices":"-","WorkstationName":"XAPP4"},"event_id":"4625","keywords":["Audit Failure"],"opcode":"Info","process":{"pid":1656,"thread":{"id":8744}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":4931124,"task":"Logon"}}
This is a syslog message from a product called Windows Active Directory by Microsoft. The following fields were extracted from the message:
action: Logon
clientport: 50348
messagetype: auth_failure
productids: [6]
senderhost: xapp4.uwca.org
sensitivity: normal
severitylabel: Info
sourceinfo: unknown
tags: ['v8', 'eventId:4625', 'microsoft-windows-security-auditing', 'auth_failure']
vendorcode: 4931124
streamName: microsoft-windows-security-auditing
clientIP: 123.45.3.248
userName: nighthawk