WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=230.46.62.36 ::: message={"access_device":{"epkey":"EPK4RZKTCW53E2CPMGWL","hostname":null,"ip":"230.46.62.36","location":{"city":"Aldie","country":"United States","state":"Virginia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"230.46.62.36","key":"DPWCVC9BFN5WQAS73MPY","location":{"city":"Aldie","country":"United States","state":"Virginia"},"name":"703-459-0549"},"email":"alice@oscorputilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-02-28T14:44:14.478268+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1677595454,"txid":"197c70c5-ffbf-4f76-9ffd-0fa93c47437c","user":{"groups":[],"key":"DUNRXCFGBTAY1AR7A5AG","name":"alice"}} ::: clientIP=230.46.62.36 ::: userName=alice ::: created_at=1677595454 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1677595454 ::: clientHostname=703-459-0549 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1677595454
tags: ['DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 71.178.183.31
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: 703-459-0549
streamName: DUO
clientIP: 230.46.62.36
userName: alice