WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T18:03:17.743Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"1202","created":"2024-07-26T18:03:18.882Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.oscorp.com"},"log":{"level":"information"},"message":"The Federation Service validated a new credential. See XML for details. \n\nActivity ID: f30d3aba-0f19-45a2-8487-a59188e1dc0a \n\nAdditional Data \nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\n  <AuditType>FreshCredentials</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>N/A</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\jreed</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>N/A</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.oscorp.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>73.237.142.2</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>Windows-AzureAD-Authentication-Provider/1.0</UserAgentString>\n      <Endpoint>/adfs/services/trust/13/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>","organization":"oscorp","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.oscorp.com","event_data":{"param1":"f30d3aba-0f19-45a2-8487-a59188e1dc0a","param2":"<?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\n  <AuditType>FreshCredentials</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>N/A</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\jreed</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>N/A</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.oscorp.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>73.237.142.2</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>Windows-AzureAD-Authentication-Provider/1.0</UserAgentString>\n      <Endpoint>/adfs/services/trust/13/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>"},"event_id":"1202","keywords":["Audit Success","Classic"],"provider_name":"AD FS Auditing","record_id":1388168145,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T18:03:17.743Z\",\"agent\":{\"ephemeral_id\":\"2684bcd2-4a2b-4981-9139-d620c6b2af92\",\"id\":\"a5def5dd-6173-4dfd-bc91-3ca20122db53\",\"name\":\"Nordc-APP-ADFS1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"1202\",\"created\":\"2024-07-26T18:03:18.882Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"AD FS Auditing\"},\"host\":{\"name\":\"Nordc-APP-ADFS1.oscorp.com\"},\"log\":{\"level\":\"information\"},\"message\":\"The Federation Service validated a new credential. See XML for details. \\n\\nActivity ID: f30d3aba-0f19-45a2-8487-a59188e1dc0a \\n\\nAdditional Data \\nXML: <?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?>\\n<AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"FreshCredentialAudit\\\">\\n  <AuditType>FreshCredentials</AuditType>\\n  <AuditResult>Success</AuditResult>\\n  <FailureType>None</FailureType>\\n  <ErrorCode>N/A</ErrorCode>\\n  <ContextComponents>\\n    <Component xsi:type=\\\"ResourceAuditComponent\\\">\\n      <RelyingParty>N/A</RelyingParty>\\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\\n      <UserId>MDS-ATL\\\\jreed</UserId>\\n    </Component>\\n    <Component xsi:type=\\\"AuthNAuditComponent\\\">\\n      <PrimaryAuth>N/A</PrimaryAuth>\\n      <DeviceAuth>false</DeviceAuth>\\n      <DeviceId>N/A</DeviceId>\\n      <MfaPerformed>false</MfaPerformed>\\n      <MfaMethod>N/A</MfaMethod>\\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\\n      <TokenBindingReferredId>false</TokenBindingReferredId>\\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\\n    </Component>\\n    <Component xsi:type=\\\"ProtocolAuditComponent\\\">\\n      <OAuthClientId>N/A</OAuthClientId>\\n      <OAuthGrant>N/A</OAuthGrant>\\n    </Component>\\n    <Component xsi:type=\\\"RequestAuditComponent\\\">\\n      <Server>http://adfs.oscorp.com/adfs/services/trust</Server>\\n      <AuthProtocol>N/A</AuthProtocol>\\n      <NetworkLocation>Intranet</NetworkLocation>\\n      <IpAddress>73.237.142.2</IpAddress>\\n      <ForwardedIpAddress />\\n      <ProxyIpAddress>N/A</ProxyIpAddress>\\n      <NetworkIpAddress>N/A</NetworkIpAddress>\\n      <ProxyServer>N/A</ProxyServer>\\n      <UserAgentString>Windows-AzureAD-Authentication-Provider/1.0</UserAgentString>\\n      <Endpoint>/adfs/services/trust/13/usernamemixed</Endpoint>\\n    </Component>\\n  </ContextComponents>\\n</AuditBase>\",\"organization\":\"oscorp\",\"senderHost\":\"192.168.10.55\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Nordc-APP-ADFS1.oscorp.com\",\"event_data\":{\"param1\":\"f30d3aba-0f19-45a2-8487-a59188e1dc0a\",\"param2\":\"<?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?>\\n<AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"FreshCredentialAudit\\\">\\n  <AuditType>FreshCredentials</AuditType>\\n  <AuditResult>Success</AuditResult>\\n  <FailureType>None</FailureType>\\n  <ErrorCode>N/A</ErrorCode>\\n  <ContextComponents>\\n    <Component xsi:type=\\\"ResourceAuditComponent\\\">\\n      <RelyingParty>N/A</RelyingParty>\\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\\n      <UserId>MDS-ATL\\\\jreed</UserId>\\n    </Component>\\n    <Component xsi:type=\\\"AuthNAuditComponent\\\">\\n      <PrimaryAuth>N/A</PrimaryAuth>\\n      <DeviceAuth>false</DeviceAuth>\\n      <DeviceId>N/A</DeviceId>\\n      <MfaPerformed>false</MfaPerformed>\\n      <MfaMethod>N/A</MfaMethod>\\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\\n      <TokenBindingReferredId>false</TokenBindingReferredId>\\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\\n    </Component>\\n    <Component xsi:type=\\\"ProtocolAuditComponent\\\">\\n      <OAuthClientId>N/A</OAuthClientId>\\n      <OAuthGrant>N/A</OAuthGrant>\\n    </Component>\\n    <Component xsi:type=\\\"RequestAuditComponent\\\">\\n      <Server>http://adfs.oscorp.com/adfs/services/trust</Server>\\n      <AuthProtocol>N/A</AuthProtocol>\\n      <NetworkLocation>Intranet</NetworkLocation>\\n      <IpAddress>73.237.142.2</IpAddress>\\n      <ForwardedIpAddress />\\n      <ProxyIpAddress>N/A</ProxyIpAddress>\\n      <NetworkIpAddress>N/A</NetworkIpAddress>\\n      <ProxyServer>N/A</ProxyServer>\\n      <UserAgentString>Windows-AzureAD-Authentication-Provider/1.0</UserAgentString>\\n      <Endpoint>/adfs/services/trust/13/usernamemixed</Endpoint>\\n    </Component>\\n  </ContextComponents>\\n</AuditBase>\"},\"event_id\":\"1202\",\"keywords\":[\"Audit Success\",\"Classic\"],\"provider_name\":\"AD FS Auditing\",\"record_id\":1388168145,\"user\":{\"domain\":\"MDS-ATL\",\"identifier\":\"S-1-5-21-1725571127-999974082-2044928816-27902\",\"name\":\"adfs\",\"type\":\"User\"}}}",
    "messageType": "1202",
    "senderHost": "192.168.10.55",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "ad fs auditing",
    "tags": [
        "v8",
        "eventId:1202",
        "ad fs auditing",
        "1202"
    ],
    "vendorCode": "1388168145"
}