WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T13:14:35.242Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"510","created":"2024-07-26T13:14:35.782Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.wayne.com"},"log":{"level":"information"},"message":"More information for the event entry with Instance ID 61560646-da78-424d-a5c0-9d242ab08178. There may be more events with the same Instance ID with more information. \n \nInstance ID:  \n61560646-da78-424d-a5c0-9d242ab08178 \n \nDetails: \n{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate,  \nbr\",\"Accept-Language\":\"en-US,en;q=0.5\",\"Host\":\"adfs.wayne.com\",\"Referer\":\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026redirect_uri=ms-appx-web%3a{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, fMicrosoft.AAD.BrokerPlugin{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, fd3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026resource=https%3a{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, foutlook.office365.com{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, f\\u0026add_account=multiple\\u0026pr \nompt=login\\u0026login_hint=lbizune%40wayne.com\\u0026response_mode=form_post\\u0026msafed=0\\u0026windows_api_version=2.0.1\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\",\"User-Agent\":\"Mozilla/5.0 (Windows  \nNT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\",\"X-MS-Endpoint-Absolute-Path\":\"/adfs/ls/\"} \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n- \n-","organization":"wayne","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.wayne.com","event_data":{"param1":"61560646-da78-424d-a5c0-9d242ab08178","param10":"-","param11":"-","param12":"-","param13":"-","param14":"-","param15":"-","param16":"-","param17":"-","param18":"-","param19":"-","param2":"{\"Upgrade-Insecure-Requests\":\"1\",\"Connection\":\"Keep-Alive\",\"Accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"Accept-Encoding\":\"gzip, deflate, ","param20":"-","param21":"-","param3":"br\",\"Accept-Language\":\"en-US,en;q=0.5\",\"Host\":\"adfs.wayne.com\",\"Referer\":\"https://login.microsoftonline.com/common/oauth2/authorize?response_type=code\\u0026client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026redirect_uri=ms-appx-web%3a%2f%2fMicrosoft.AAD.BrokerPlugin%2fd3590ed6-52b3-4102-aeff-aad2292ab01c\\u0026resource=https%3a%2f%2foutlook.office365.com%2f\\u0026add_account=multiple\\u0026pr","param4":"ompt=login\\u0026login_hint=lbizune%40wayne.com\\u0026response_mode=form_post\\u0026msafed=0\\u0026windows_api_version=2.0.1\\u0026sso_nonce=AwABEgEWAYNEACAOz_BQD0_z8TzrF1qBSD6JN-B-mFmMcPWe8hLsMyCo2k-zE68O3QChm1g9zX7Dc8CMo6TXCasnwrq1RT9JEX5K0MC8N2xBIgAA\\u0026client-request-id=73a12283-700c-4a2b-bb9d-39ade95707a9\\u0026mscrid=73a12283-700c-4a2b-bb9d-39ade95707a9\",\"User-Agent\":\"Mozilla/5.0 (Windows ","param5":"NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\",\"X-MS-Endpoint-Absolute-Path\":\"/adfs/ls/\"}","param6":"-","param7":"-","param8":"-","param9":"-"},"event_id":"510","keywords":["Audit Success","Classic"],"provider_name":"AD FS Auditing","record_id":1388042049,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
Product: ad fs auditing
Vendor: ad fs auditing