WitFoo-Artifact ::: action=FAILURE ::: streamName=Okta ::: severityLabel=ERROR ::: message={"actor":{"alternateId":"nighthawk","detailEntry":null,"displayName":"TAnderson Admin","id":"00u1768rxuCoeW0Qm697","type":"User"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"trsjCN6e6Q_TeWiYEOkdbV6vg","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Las Vegas","country":"United States","geolocation":{"lat":36.1685,"lon":-115.1164},"postalCode":"89101","state":"Nevada"},"id":"cappT0Hfy97F1BoO1UTR","ipAddress":"100.207.174.98","userAgent":{"browser":"UNKNOWN","os":"Windows 8","rawUserAgent":"Okta AD Agent/3.16.1 (Microsoft Windows NT 6.2.9200.0; .NET CLR 4.0.30319.42000; 64-bit OS; 64-bit Process; sslpinning=disabled)"},"zone":"null"},"debugContext":{"debugData":{"dtHash":"6f9aadba8adbed6cc725293f82e786b12e8cbbf43909b90f570b2a356f6fa8ff","requestId":"dbf10bf4cefcf0a7ce49b8eafccf16d0","requestUri":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a539kiyvwggVTfYyD697/actionResult","url":"/api/1/internal/app/activedirectory/0oa16yxhp6iUzuI2b697/agent/a539kiyvwggVTfYyD697/actionResult?responseId=d60e6e22-63aa-47f2-a12c-28b42b272145"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.agent.user_auth.error","outcome":{"reason":"Login Failed","result":"FAILURE"},"published":"2024-02-21T07:35:19.123Z","request":{"ipChain":[{"geographicalContext":{"city":"Las Vegas","country":"United States","geolocation":{"lat":36.1685,"lon":-115.1164},"postalCode":"89101","state":"Nevada"},"ip":"100.207.174.98","source":null,"version":"V4"}]},"securityContext":{"asNumber":174,"asOrg":"psinet  inc.","domain":"cogentco.com","isProxy":false,"isp":"cogent communications"},"severity":"ERROR","target":[{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{"requestApiTokenId":"00T144bkn6dBONmdv697"},"id":"dbf10bf4cefcf0a7ce49b8eafccf16d0","type":"WEB"},"uuid":"c3551ada-d08b-11ee-8e67-6f50371e48a2","version":"0"} ::: clientIP=100.207.174.98 ::: program=okta ::: severityCode=2 ::: userName=nighthawk ::: clientGUID=cappT0Hfy97F1BoO1UTR ::: messageType=auth_failure
This is a syslog message from a product called Okta by Okta. The following fields were extracted from the message:
action: FAILURE
clientguid: cappT0Hfy97F1BoO1UTR
messagetype: auth_failure
productids: [6]
program: okta
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
tags: ['Okta', 'auth_failure']
streamName: Okta
clientIP: 100.207.174.98
userName: nighthawk