WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T20:01:25.443Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"413","created":"2024-07-26T20:01:27.422Z","kind":"event","outcome":"failure","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.umbrella.com"},"log":{"level":"information"},"message":"An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request. The data includes an Activity ID that you can cross-reference to error or warning events to help diagnose the problem that caused this error.  \n\nAdditional Data \n\nActivity ID:\n 144fa98d-6a73-463f-b1dc-4bbe9dce40fc \n\nCaller:\n MDS-ATL\\kfonville\n \n\nOnBehalfOf user:\n - \n\nActAs user:\n - \n\nTarget Relying Party:\n urn:federation:MicrosoftOnline \n\nDevice identity:\n - \n\nClient IP: \n 172.16.100.9 \n\nUser action: \nUse the Activity ID data in this message to search and correlate the data to events in the Event log using Event Viewer. This Activity ID will also be shown as additional information in the error page when an error occurs in the federation passive Web application.","organization":"umbrella","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.umbrella.com","event_data":{"param1":"144fa98d-6a73-463f-b1dc-4bbe9dce40fc","param2":"MDS-ATL\\kfonville","param3":"-","param4":"-","param5":"urn:federation:MicrosoftOnline","param6":"-","param7":"172.16.100.9"},"event_id":"413","keywords":["Audit Failure","Classic"],"opcode":"Info","provider_name":"AD FS Auditing","record_id":1388212433,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T20:01:25.443Z\",\"agent\":{\"ephemeral_id\":\"2684bcd2-4a2b-4981-9139-d620c6b2af92\",\"id\":\"a5def5dd-6173-4dfd-bc91-3ca20122db53\",\"name\":\"Nordc-APP-ADFS1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"413\",\"created\":\"2024-07-26T20:01:27.422Z\",\"kind\":\"event\",\"outcome\":\"failure\",\"provider\":\"AD FS Auditing\"},\"host\":{\"name\":\"Nordc-APP-ADFS1.umbrella.com\"},\"log\":{\"level\":\"information\"},\"message\":\"An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request. The data includes an Activity ID that you can cross-reference to error or warning events to help diagnose the problem that caused this error.  \\n\\nAdditional Data \\n\\nActivity ID:\\n 144fa98d-6a73-463f-b1dc-4bbe9dce40fc \\n\\nCaller:\\n MDS-ATL\\\\kfonville\\n \\n\\nOnBehalfOf user:\\n - \\n\\nActAs user:\\n - \\n\\nTarget Relying Party:\\n urn:federation:MicrosoftOnline \\n\\nDevice identity:\\n - \\n\\nClient IP: \\n 172.16.100.9 \\n\\nUser action: \\nUse the Activity ID data in this message to search and correlate the data to events in the Event log using Event Viewer. This Activity ID will also be shown as additional information in the error page when an error occurs in the federation passive Web application.\",\"organization\":\"umbrella\",\"senderHost\":\"192.168.10.55\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Nordc-APP-ADFS1.umbrella.com\",\"event_data\":{\"param1\":\"144fa98d-6a73-463f-b1dc-4bbe9dce40fc\",\"param2\":\"MDS-ATL\\\\kfonville\",\"param3\":\"-\",\"param4\":\"-\",\"param5\":\"urn:federation:MicrosoftOnline\",\"param6\":\"-\",\"param7\":\"172.16.100.9\"},\"event_id\":\"413\",\"keywords\":[\"Audit Failure\",\"Classic\"],\"opcode\":\"Info\",\"provider_name\":\"AD FS Auditing\",\"record_id\":1388212433,\"user\":{\"domain\":\"MDS-ATL\",\"identifier\":\"S-1-5-21-1725571127-999974082-2044928816-27902\",\"name\":\"adfs\",\"type\":\"User\"}}}",
    "messageType": "413",
    "senderHost": "192.168.10.55",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "ad fs auditing",
    "tags": [
        "v8",
        "eventId:413",
        "ad fs auditing",
        "413"
    ],
    "vendorCode": "1388212433"
}