WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=241.40.221.15 ::: message={"access_device":{"epkey":"EPJW66LYFD913B218I1A","hostname":null,"ip":"241.40.221.15","location":{"city":"Woodstock","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"241.40.221.15","key":"DPVCMGDI3V8RZSDZKVJ2","location":{"city":"Woodstock","country":"United States","state":"Georgia"},"name":"678-296-5171"},"email":"cgates@wayneelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-04-13T13:51:23.380661+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1681393883,"txid":"f89ca5e9-a1f4-4b02-90ea-38aba7d4c68d","user":{"groups":[],"key":"DU1FUSBDLA1TT6M87K2A","name":"alice"}} ::: clientIP=241.40.221.15 ::: userName=alice ::: created_at=1681393883 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1681393883 ::: clientHostname=678-296-5171 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1681393883
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 69.221.251.136
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: 678-296-5171
streamName: DUO
clientIP: 241.40.221.15
userName: alice