<110>2024-07-26T23:35:10.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = FIMAuditReports ]  [ REPORT_PROFILE = Network share Read ]  [ EVENT_NUMBER = 5140 ]  [ TIME_GENERATED = 1722051310 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = NORDC-APP-FS01 ]  [ REMARKS = A network share object was accessed. ]  [ HANDLE_ID = null ]  [ OBJECT_NAME = \??\D:\Corporate ]  [ UNC_NAME = \\*\Corporate ]  [ FILE_NAME = Corporate ]  [ FILE_LOCATION = \??\D:\ ]  [ LOGON_ID = 0x7f7faf412 ]  [ DOMAIN = umbrella.com ]  [ ACCESSES = ReadData (or ListDirectory) ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ TRANSACTION_ID = null ]  [ ACCESS_MASK = 1 ]  [ USERNAME = rpa01 ]  [ RECORD_NUMBER = 4221418118 ]  [ USER_SID = S-1-5-21-1725571127-999974082-2044928816-27045 ]  [ ACCESS_TYPE = 1 ]  [ ACCESS_TYPE_TEXT = File/Folder Read ]  [ FORMAT_MESSAGE = User 'rpa01' Read file/folder '\??\D:\Corporate'. ]  [ USER_SAM_ACCOUNT_NAME = null ]  [ USER_DISPLAY_NAME = Robot Process Automation ]  [ USER_PRINCIPAL_NAME = null ]  [ USER_GUID = null ]  [ USER_DISTINGUISH_NAME = CN=Robot Process Automation,OU=Mail-Enabled Service Accounts,OU=MDS-ATL Exempt User Directory,OU=Corp-Users,DC=umbrella,DC=com ]  [ USER_OU_GUID = {7A6E22FC-FF34-459E-BF31-F5DD264CF5F1} ]  [ USER_DEPARTMENT = null ]  [ USER_MANAGER_NAME = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = Folder ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ NEW_PRIVILEGES_USED = null ] 
This is a syslog message from a product called ManageEngine ADManager by ManageEngine. The following fields were extracted from the message:
facilityCode: 13
facilityLabel: log audit
fieldExtractorName: ad_audit_plus
localHostname: Nordc-app-Dell
localStartTime: 2024-07-26T23:35:10.000-04:00
messageType: audit_log
priority: 110
program: ADAuditPlus
senderHost: 192.168.10.233
sensitivity: normal
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: ad_audit_plus
tags: ['rfc3164', 'ad_audit_plus', 'audit_log']