<110>2024-03-27T10:27:09.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = GroupMgmtReports ]  [ REPORT_PROFILE = Security Group Membership Changes ]  [ SOURCE = nordc-dc-03.oscorp.com ]  [ GROUP_TYPE = Security ]  [ GROUP_SCOPE = Global ]  [ GROUP_MGMT_TYPE = - ]  [ FORMAT_MESSAGE = Member 'CN=Terrelle Owens,OU=Augusta Desktop Users,OU=Region-South GA Desktop Users,OU=MDS-ATL Desktop User Directory,OU=Corp-Users,DC=oscorp,DC=com' was added to Global Security Group 'Simpplr_Users' by 'MDS-ATL\ssmith'. ]  [ TIME_GENERATED = 1711549629 ]  [ PRIVILEGES = - ]  [ ACCOUNT_NAME = Simpplr_Users ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-40191} ]  [ CALLER_USER_NAME = ssmith ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ CALLER_LOGON_ID = 0x16bb8b20c ]  [ SAM_ACCOUNT_NAME = null ]  [ SID_HISTORY = null ]  [ OLD_ACCOUNT_NAME = null ]  [ MEMBER_NAME = CN=Terrelle Owens,OU=Augusta Desktop Users,OU=Region-South GA Desktop Users,OU=MDS-ATL Desktop User Directory,OU=Corp-Users,DC=oscorp,DC=com ]  [ MEMBER_SID = S-1-5-21-1725571127-999974082-2044928816-36690 ]  [ EVENT_NUMBER = 4728 ]  [ REMARKS = A member was added to a security-enabled global group. ]  [ RECORD_NUMBER = 1041091106 ]  [ CALLER_USER_SID = S-1-5-21-1725571127-999974082-2044928816-21433 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = Simpplr_Users ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=Simpplr_Users,OU=Security Groups - Local,OU=Corp-Groups,DC=oscorp,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {B79FCDFD-311B-4DF5-92CE-DA9EA57C6FAC} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = Shawn Smith ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = CN=Shawn Smith,OU=ADMP Admins,OU=GPO Test,OU=Administrative Accounts,OU=MDS-ATL Exempt User Directory,OU=Corp-Users,DC=oscorp,DC=com ]  [ CALLER_USER_OU_GUID = {1E300D52-93CC-436A-96B2-9864D4269F10} ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ MEMBER_SAM_ACCOUNT_NAME = towens ]  [ MEMBER_DISPLAY_NAME = Terrelle Owens ]  [ MEMBER_USER_PRINCIPAL_NAME = null ]  [ MEMBER_USER_GUID = {39748695-8ACB-40C0-B62A-3E16F797DD89} ]  [ MEMBER_DISTINGUISH_NAME = null ]  [ MEMBER_NAME_OU_GUID = {4E82EE5C-2B8F-430D-9327-1CA26AA869FC} ]  [ MEMBER_USER_DEPARTMENT = null ]  [ MEMBER_USER_MANAGER_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = - ]  [ EXTRA_COLUMN5 = 192.168.10.13 ]  [ EXTRA_COLUMN6 = Network (i.e. connection to shared folder on this computer from elsewhere on network or IIS logon) ]  [ EXTRA_COLUMN7 = 3 ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ PERMISSION_CHANGES = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] 
This is a syslog message from a product called ManageEngine ADManager by ManageEngine. The following fields were extracted from the message:
facilityCode: 13
facilityLabel: log audit
fieldExtractorName: ad_audit_plus
localHostname: Nordc-app-Dell
localStartTime: 2024-03-27T10:27:09.000-04:00
messageType: audit_log
priority: 110
program: ADAuditPlus
senderHost: 192.168.10.233
sensitivity: normal
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: ad_audit_plus
tags: ['rfc3164', 'ad_audit_plus', 'audit_log']