WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T16:55:39.020Z","agent":{"ephemeral_id":"1a816226-5520-4d19-9f0a-910bd50c2191","id":"c6a28f12-5e1b-489b-b0d6-dae12936f03e","name":"TS02-2016","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"WinSqmUserLogin","code":"7001","created":"2024-07-26T16:55:40.274Z","kind":"event","provider":"Microsoft-Windows-Winlogon"},"host":{"name":"TS02-2016.stark.com"},"log":{"level":"information"},"message":"User Logon Notification for Customer Experience Improvement Program","organization":"stark","senderHost":"NORDC-SXESTAGE0.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"System","computer_name":"TS02-2016.stark.com","event_data":{"TSId":"14","UserSid":"S-1-5-21-1725571127-999974082-2044928816-26186"},"event_id":"7001","keywords":["ms:Telemetry"],"opcode":"Info","process":{"pid":13664,"thread":{"id":11148}},"provider_guid":"{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}","provider_name":"Microsoft-Windows-Winlogon","record_id":167160,"task":"WinSqmUserLogin","user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
Product: microsoft-windows-winlogon
Vendor: microsoft-windows-winlogon