WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T12:28:38.180Z","agent":{"ephemeral_id":"b6fca6ca-2a1b-4b4b-837b-e1b233231891","id":"68d26628-116d-42f1-a6e0-d53dfced01df","name":"NORDC-APP-LATz2","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-26T12:28:42.474Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-APP-LATz2.umbrella.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x0000000000001b68\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{41374d65-bb13-4334-8cf4-8b2ed493e170}\n Shadow ID:\t\t\t{9950ab7f-46e3-425f-996f-c70f5005498f}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Mumbrellaine:\t\tNORDC-APP-LATz2.umbrella.com\n Original Volume:\t\t\t\\\\?\\Volume{dd429781-c3c2-406b-8e2d-78099a5485b5}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy467","organization":"umbrella","senderHost":"NORDC-APP-LATz2.umbrella.com","sensitivity":"normal","winlog":{"activity_id":"{6ca506b2-bea4-4044-9b78-a022693f90ec}","api":"wineventlog","channel":"Security","computer_name":"NORDC-APP-LATz2.umbrella.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy467","param2":"NT AUTHORITY\\SYSTEM","param3":"0x0000000000001b68","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{41374d65-bb13-4334-8cf4-8b2ed493e170}","param6":"{9950ab7f-46e3-425f-996f-c70f5005498f}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-APP-LATz2.umbrella.com","param9":"\\\\?\\Volume{dd429781-c3c2-406b-8e2d-78099a5485b5}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","process":{"pid":696,"thread":{"id":10568}},"provider_name":"VSSAudit","record_id":233084351,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
Product: vssaudit
Vendor: vssaudit