WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T03:43:12.000Z","agent":{"ephemeral_id":"964d0404-9b18-4f2b-a3fe-7db4be557fbf","id":"8809f950-580f-4473-8f56-fd5ca481b748","name":"Proteus","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-27T03:43:13.055Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"Proteus.umbrella.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint d9 3c 38 6e 62 d3 d7 ce fc 5a 6f 40 5f 84 36 c1 0d b5 8f e6 is about to expire or already expired.","organization":"umbrella","senderHost":"Proteus.umbrella.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"Proteus.umbrella.com","event_data":{"Context":"local system","ObjId":"d9 3c 38 6e 62 d3 d7 ce fc 5a 6f 40 5f 84 36 c1 0d b5 8f e6"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1291405,"task":"None"}}
This is a syslog message from a product called microsoft-windows-certificateservicesclient-autoenrollment by microsoft-windows-certificateservicesclient-autoenrollment. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 64
senderHost: Proteus.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-certificateservicesclient-autoenrollment
tags: ['v8', 'eventId:64', 'microsoft-windows-certificateservicesclient-autoenrollment', '64']
vendorCode: 1291405