WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:20:09.001Z","agent":{"ephemeral_id":"9e8b3684-f98e-4660-a5f0-b9055e0435e9","id":"60a0a7eb-8adf-44b2-8571-636680a0f5cd","name":"NORDC-APP-FS01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T13:20:09.148Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-FS01.acme.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad is about to expire or already expired.","organization":"acme","senderHost":"nordc-app-fs01.acme.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-FS01.acme.com","event_data":{"Context":"local system","ObjId":"a7 97 10 47 68 de cc 7e 96 87 dd 24 0a 59 2a 90 f0 34 cc ad"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":1284642,"task":"None"}}
This is a syslog message from a product called microsoft-windows-certificateservicesclient-autoenrollment by microsoft-windows-certificateservicesclient-autoenrollment. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 64
senderHost: nordc-app-fs01.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-certificateservicesclient-autoenrollment
tags: ['v8', 'eventId:64', 'microsoft-windows-certificateservicesclient-autoenrollment', '64']
vendorCode: 1284642