WitFoo-Artifact ::: program=okta ::: streamName=Okta ::: messageType=auth_failure ::: severityLabel=ERROR ::: severityCode=2 ::: action=FAILURE ::: userName=nighthawk ::: message={"actor":{"alternateId":"nighthawk","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idx0ztEBPZ2RaytOeuhARI8Ww","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.7104,"lon":-117.0528},"postalCode":"92114","state":"California"},"id":null,"ipAddress":"31.149.41.91","userAgent":{"browser":"IE11","os":"Windows 8","rawUserAgent":"Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs19c.auw2-ok14.internal//1707496475231//1ea1a990b61373858a8c6fc8d5dc1b0f:3ba646a5-d05a-4f12-a8fc-cba6ed698698:","agentid":"a539kiyvwggVTfYyD697","authnRequestId":"cc873f60309288931260a06599c5c609","behaviors":"{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}","delauthtimeout":"4000","delauthtimespentatagent":"45","delauthtimespentatdomaincontroller":"45","delauthtimetotal":"451","deviceFingerprint":"b0577515316ff08d7d102031ef562336","dtHash":"9783c3cc7c9ff1527fb8932f3160bdaff8565f7221b40ce52ffe1a2343b5a8cf","errorCode":"1326","requestId":"1ea1a990b61373858a8c6fc8d5dc1b0f","requestUri":"/idp/idx/identify","risk":"{level=LOW}","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T16:34:31.683Z","request":{"ipChain":[{"geographicalContext":{"city":"San Diego","country":"United States","geolocation":{"lat":32.7104,"lon":-117.0528},"postalCode":"92114","state":"California"},"ip":"31.149.41.91","source":null,"version":"V4"}]},"securityContext":{"asNumber":7018,"asOrg":"at\u0026t corp.","domain":"sbcglobal.net","isProxy":false,"isp":"att services inc"},"severity":"ERROR","target":[{"alternateId":"macademia@wayne.bank","detailEntry":null,"displayName":"Marcelina Academia","id":"0ua16z1k092LIDehY697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"1ea1a990b61373858a8c6fc8d5dc1b0f","type":"WEB"},"uuid":"1a00fdc3-c769-11ee-a243-419d6dbaf222","version":"0"} ::: clientIP=31.149.41.91
{
    "action": "FAILURE",
    "message": "WitFoo-Artifact ::: program=okta ::: streamName=Okta ::: messageType=auth_failure ::: severityLabel=ERROR ::: severityCode=2 ::: action=FAILURE ::: userName=nighthawk ::: message={\"actor\":{\"alternateId\":\"nighthawk\",\"detailEntry\":null,\"displayName\":\"Okta System\",\"id\":\"spr16ygr5qFPw1bhs697\",\"type\":\"SystemPrincipal\"},\"authenticationContext\":{\"authenticationProvider\":\"ACTIVE_DIRECTORY\",\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":\"PASSWORD\",\"externalSessionId\":\"idx0ztEBPZ2RaytOeuhARI8Ww\",\"interface\":\"AD APP Instance\",\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"San Diego\",\"country\":\"United States\",\"geolocation\":{\"lat\":32.7104,\"lon\":-117.0528},\"postalCode\":\"92114\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"31.149.41.91\",\"userAgent\":{\"browser\":\"IE11\",\"os\":\"Windows 8\",\"rawUserAgent\":\"Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"actionid\":\"rpc::app.active_directory.agent.reply.ok14-majorecs19c.auw2-ok14.internal//1707496475231//1ea1a990b61373858a8c6fc8d5dc1b0f:3ba646a5-d05a-4f12-a8fc-cba6ed698698:\",\"agentid\":\"a539kiyvwggVTfYyD697\",\"authnRequestId\":\"cc873f60309288931260a06599c5c609\",\"behaviors\":\"{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}\",\"delauthtimeout\":\"4000\",\"delauthtimespentatagent\":\"45\",\"delauthtimespentatdomaincontroller\":\"45\",\"delauthtimetotal\":\"451\",\"deviceFingerprint\":\"b0577515316ff08d7d102031ef562336\",\"dtHash\":\"9783c3cc7c9ff1527fb8932f3160bdaff8565f7221b40ce52ffe1a2343b5a8cf\",\"errorCode\":\"1326\",\"requestId\":\"1ea1a990b61373858a8c6fc8d5dc1b0f\",\"requestUri\":\"/idp/idx/identify\",\"risk\":\"{level=LOW}\",\"threatSuspected\":\"false\",\"url\":\"/idp/idx/identify?\"}},\"device\":null,\"displayMessage\":\"Authenticate user with AD agent\",\"eventType\":\"user.authentication.auth_via_AD_agent\",\"legacyEventType\":\"app.ad.login.bad_password\",\"outcome\":{\"reason\":\"Authentication failed: bad username or password\",\"result\":\"FAILURE\"},\"published\":\"2024-02-09T16:34:31.683Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"San Diego\",\"country\":\"United States\",\"geolocation\":{\"lat\":32.7104,\"lon\":-117.0528},\"postalCode\":\"92114\",\"state\":\"California\"},\"ip\":\"31.149.41.91\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":7018,\"asOrg\":\"at\\u0026t corp.\",\"domain\":\"sbcglobal.net\",\"isProxy\":false,\"isp\":\"att services inc\"},\"severity\":\"ERROR\",\"target\":[{\"alternateId\":\"macademia@wayne.bank\",\"detailEntry\":null,\"displayName\":\"Marcelina Academia\",\"id\":\"0ua16z1k092LIDehY697\",\"type\":\"AppUser\"},{\"alternateId\":\"SDPB.LOCAL\",\"detailEntry\":null,\"displayName\":\"Active Directory\",\"id\":\"0oa16yxhp6iUzuI2b697\",\"type\":\"AppInstance\"}],\"transaction\":{\"detail\":{},\"id\":\"1ea1a990b61373858a8c6fc8d5dc1b0f\",\"type\":\"WEB\"},\"uuid\":\"1a00fdc3-c769-11ee-a243-419d6dbaf222\",\"version\":\"0\"} ::: clientIP=31.149.41.91",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "program": "okta",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "tags": [
        "Okta",
        "auth_failure"
    ],
    "streamName": "Okta",
    "clientIP": "31.149.41.91",
    "userName": "nighthawk"
}