WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=26.41.38.16 ::: message={"access_device":{"browser":"Edge Chromium","browser_version":"108.0.1462.46","epkey":"EPN0K4SYNEP2ITZL2LHW","flash_version":"uninstalled","hostname":null,"ip":"26.41.38.16","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Dacula","country":"United States","state":"Georgia"},"os":"Windows","os_version":"10"},"adaptive_trust_assessments":{"more_secure_auth":{"features_version":null,"model_version":null,"policy_enabled":true,"reason":"Not requested","trust_level":"UNSET"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Novel Access IP","trust_level":"LOW"}},"alias":"","application":{"key":"DIJUUWX4H8G09X8JNJVJ","name":"MingApps Production"},"auth_device":{"ip":"26.41.38.16","key":"DP9DHID3A7MZI80Q925U","location":{"city":"Dacula","country":"United States","state":"Georgia"},"name":"770-533-0189"},"email":"bob@holdenasstark.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2022-12-11T15:37:42.160840+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1670773062,"txid":"6fd4a0ef-5c42-463b-a03a-c4edb07904c3","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DU8OSPBOEKAD6CPSRXZI","name":"bob"}} ::: program=Edge Chromium ::: clientIP=26.41.38.16 ::: userName=bob ::: created_at=1670773062 ::: streamName=DUO ::: application=MingApps Production ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1670773062 ::: clientHostname=770-533-0189 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
program: Edge Chromium
senderhost: localhost
severitylabel: critical
starttimeutc: 1670773062
tags: ['DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 73.122.198.11
sensitivity: normal
application: MingApps Production
messagetype: credential_access
clienthostname: 770-533-0189
streamName: DUO
clientIP: 26.41.38.16
userName: bob