WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T16:50:40.329Z","agent":{"ephemeral_id":"39ab588f-d36e-4a7a-a6f5-1023171b42ed","id":"d6f458d6-d6e2-4877-833b-19780e0f6d3b","name":"NVIPROCPRDWEB03","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Web Event","code":"1309","created":"2024-07-26T16:50:41.240Z","kind":"event","provider":"ASP.NET 4.0.30319.0"},"host":{"name":"NVIPROCPRDWEB03.prdnvi.wayneint.com"},"log":{"level":"warning"},"message":"Event code: 3005 \nEvent message: An unhandled exception has occurred. \nEvent time: 7/26/2024 12:50:40 PM \nEvent time (UTC): 7/26/2024 4:50:40 PM \nEvent ID: ddee6b8794cb409cb41d2fffdad7a247 \nEvent sequence: 3697 \nEvent occurrence: 16 \nEvent detail code: 0 \n \nApplication information: \n    Application domain: /LM/W3SVC/3/ROOT-1-133664508696832994 \n    Trust level: Full \n    Application Virtual Path: / \n    Application Path: D:\\PayGo\\PRD_Processing\\CheckOutWeb\\ \n    Mwayneine name: NVIPROCPRDWEB03 \n \nProcess information: \n    Process ID: 6828 \n    Process name: w3wp.exe \n    Account name: prdnvi\\procprd-appuser \n \nException information: \n    Exception type: InvalidOperationException \n    Exception message: The view 'Index' or its master was not found or no view engine supports the searched locations. The following locations were searched:\n~/Views/login/Index.aspx\n~/Views/login/Index.ascx\n~/Views/Shared/Index.aspx\n~/Views/Shared/Index.ascx\n~/Views/login/Index.cshtml\n~/Views/login/Index.vbhtml\n~/Views/Shared/Index.cshtml\n~/Views/Shared/Index.vbhtml\n   at System.Web.Mvc.ViewResult.FindView(ControllerContext context)\n   at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)\n   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\n   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)\n   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)\n\n \n \nRequest information: \n    Request URL: https://checkout.santeecooper.com:443/login?to=http://evil.com \n    Request path: /login \n    User host address: 10.160.18.137 \n    User:  \n    Is authenticated: False \n    Authentication Type:  \n    Thread account name: prdnvi\\procprd-appuser \n \nThread information: \n    Thread ID: 31 \n    Thread account name: prdnvi\\procprd-appuser \n    Is impersonating: False \n    Stack trace:    at System.Web.Mvc.ViewResult.FindView(ControllerContext context)\n   at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)\n   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\n   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)\n   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)\n \n \nCustom event details: ","organization":"wayne","senderHost":"10.160.18.53","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NVIPROCPRDWEB03.prdnvi.wayneint.com","event_data":{"param1":"3005","param10":"Full","param11":"/","param12":"D:\\PayGo\\PRD_Processing\\CheckOutWeb\\","param13":"NVIPROCPRDWEB03","param15":"6828","param16":"w3wp.exe","param17":"prdnvi\\procprd-appuser","param18":"InvalidOperationException","param19":"The view 'Index' or its master was not found or no view engine supports the searched locations. The following locations were searched:\n~/Views/login/Index.aspx\n~/Views/login/Index.ascx\n~/Views/Shared/Index.aspx\n~/Views/Shared/Index.ascx\n~/Views/login/Index.cshtml\n~/Views/login/Index.vbhtml\n~/Views/Shared/Index.cshtml\n~/Views/Shared/Index.vbhtml\n   at System.Web.Mvc.ViewResult.FindView(ControllerContext context)\n   at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)\n   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\n   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)\n   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)","param2":"An unhandled exception has occurred.","param20":"https://checkout.santeecooper.com:443/login?to=http://evil.com","param21":"/login","param22":"10.160.18.137","param24":"False","param26":"prdnvi\\procprd-appuser","param27":"31","param28":"prdnvi\\procprd-appuser","param29":"False","param3":"7/26/2024 12:50:40 PM","param30":"   at System.Web.Mvc.ViewResult.FindView(ControllerContext context)\n   at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult)\n   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState)\n   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult)\n   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)\n   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\n   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)\n   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)","param4":"7/26/2024 4:50:40 PM","param5":"ddee6b8794cb409cb41d2fffdad7a247","param6":"3697","param7":"16","param8":"0","param9":"/LM/W3SVC/3/ROOT-1-133664508696832994"},"event_id":"1309","keywords":["Classic"],"provider_name":"ASP.NET 4.0.30319.0","record_id":1484139,"task":"Web Event"}}
This is a syslog message from a product called Symantec Data Loss Prevention by Symantec. The following fields were extracted from the message:
fieldExtractorName: symantec_dlp
messageType: data_loss
productIds: [44]
senderHost: 10.160.18.53
sensitivity: normal
sourceInfo: unknown
streamName: symantec_dlp
tags: ['symantec_dlp', 'data_loss']