WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.stark.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1 is about to expire or already expired.","organization":"stark","senderHost":"nordc-app-fs01.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.stark.com","event_data":{"Context":"local system","ObjId":"33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284644,"task":"None"}}
{
    "action": "None",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T13:20:09.001Z\",\"agent\":{\"ephemeral_id\":\"9e8b3684-f98e-4660-a5f0-b9055e0435e9\",\"id\":\"60a0a7eb-8adf-44b2-8571-636680a0f5cd\",\"name\":\"NORDC-APP-FS01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"None\",\"code\":\"64\",\"created\":\"2024-07-26T13:20:09.148Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\"},\"host\":{\"name\":\"NORDC-APP-FS01.stark.com\"},\"log\":{\"level\":\"warning\"},\"message\":\"Certificate for local system with Thumbprint 33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1 is about to expire or already expired.\",\"organization\":\"stark\",\"senderHost\":\"nordc-app-fs01.stark.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Application\",\"computer_name\":\"NORDC-APP-FS01.stark.com\",\"event_data\":{\"Context\":\"local system\",\"ObjId\":\"33 d4 83 55 31 8d e0 51 e3 d1 06 74 e6 45 7e ed dc 63 c9 d1\"},\"event_id\":\"64\",\"keywords\":[\"Classic\"],\"opcode\":\"Info\",\"provider_guid\":\"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}\",\"provider_name\":\"Microsoft-Windows-CertificateServicesClient-AutoEnrollment\",\"record_id\":1284644,\"task\":\"None\"}}",
    "messageType": "64",
    "senderHost": "nordc-app-fs01.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-certificateservicesclient-autoenrollment",
    "tags": [
        "v8",
        "eventId:64",
        "microsoft-windows-certificateservicesclient-autoenrollment",
        "64"
    ],
    "vendorCode": "1284644"
}