WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=162.48.210.168 ::: message={"access_device":{"epkey":"EPUDXMH1GCXXJHSLOCI2","hostname":null,"ip":"162.48.210.168","location":{"city":"Roswell","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"162.48.210.168","key":"DPWIE5HCBJCEVJG0OMNJ","location":{"city":"Roswell","country":"United States","state":"Georgia"},"name":"770-598-5251"},"email":"bob@oscorputilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-07-20T17:57:14.081853+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1689875834,"trusted_endpoint_status":"unknown","txid":"a8f6d86e-dfb0-4a18-945e-6eb256af30f3","user":{"groups":[],"key":"DUMPW26IGX0PKQOKXGYQ","name":"bob"}} ::: clientIP=162.48.210.168 ::: userName=bob ::: created_at=1689875834 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1689875834 ::: clientHostname=770-598-5251 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 770-598-5251
localip: 96.32.218.45
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1689875834
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 162.48.210.168
userName: bob