WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T05:00:08.495Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"1200","created":"2024-07-27T05:00:10.292Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.wayne.com"},"log":{"level":"information"},"message":"The Federation Service issued a valid token. See XML for details. \n\nActivity ID: 68d0163a-b68e-43a0-be66-ac6f0fd72a1f \n\nAdditional Data \nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\n  <AuditType>AppToken</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\singlesource</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.wayne.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>192.168.14.46</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>N/A</UserAgentString>\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>","organization":"wayne","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.wayne.com","event_data":{"param1":"68d0163a-b68e-43a0-be66-ac6f0fd72a1f","param2":"<?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\n  <AuditType>AppToken</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>MDS-ATL\\singlesource</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>false</MfaPerformed>\n      <MfaMethod>N/A</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.wayne.com/adfs/services/trust</Server>\n      <AuthProtocol>N/A</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>192.168.14.46</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>N/A</UserAgentString>\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>"},"event_id":"1200","keywords":["Classic","Audit Success"],"provider_name":"AD FS Auditing","record_id":1388401591,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-27T05:00:08.495Z\",\"agent\":{\"ephemeral_id\":\"2684bcd2-4a2b-4981-9139-d620c6b2af92\",\"id\":\"a5def5dd-6173-4dfd-bc91-3ca20122db53\",\"name\":\"Nordc-APP-ADFS1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"1200\",\"created\":\"2024-07-27T05:00:10.292Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"AD FS Auditing\"},\"host\":{\"name\":\"Nordc-APP-ADFS1.wayne.com\"},\"log\":{\"level\":\"information\"},\"message\":\"The Federation Service issued a valid token. See XML for details. \\n\\nActivity ID: 68d0163a-b68e-43a0-be66-ac6f0fd72a1f \\n\\nAdditional Data \\nXML: <?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?>\\n<AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"AppTokenAudit\\\">\\n  <AuditType>AppToken</AuditType>\\n  <AuditResult>Success</AuditResult>\\n  <FailureType>None</FailureType>\\n  <ErrorCode>N/A</ErrorCode>\\n  <ContextComponents>\\n    <Component xsi:type=\\\"ResourceAuditComponent\\\">\\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\\n      <UserId>MDS-ATL\\\\singlesource</UserId>\\n    </Component>\\n    <Component xsi:type=\\\"AuthNAuditComponent\\\">\\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\\n      <DeviceAuth>false</DeviceAuth>\\n      <DeviceId>N/A</DeviceId>\\n      <MfaPerformed>false</MfaPerformed>\\n      <MfaMethod>N/A</MfaMethod>\\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\\n      <TokenBindingReferredId>false</TokenBindingReferredId>\\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\\n    </Component>\\n    <Component xsi:type=\\\"ProtocolAuditComponent\\\">\\n      <OAuthClientId>N/A</OAuthClientId>\\n      <OAuthGrant>N/A</OAuthGrant>\\n    </Component>\\n    <Component xsi:type=\\\"RequestAuditComponent\\\">\\n      <Server>http://adfs.wayne.com/adfs/services/trust</Server>\\n      <AuthProtocol>N/A</AuthProtocol>\\n      <NetworkLocation>Intranet</NetworkLocation>\\n      <IpAddress>192.168.14.46</IpAddress>\\n      <ForwardedIpAddress />\\n      <ProxyIpAddress>N/A</ProxyIpAddress>\\n      <NetworkIpAddress>N/A</NetworkIpAddress>\\n      <ProxyServer>N/A</ProxyServer>\\n      <UserAgentString>N/A</UserAgentString>\\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\\n    </Component>\\n  </ContextComponents>\\n</AuditBase>\",\"organization\":\"wayne\",\"senderHost\":\"192.168.10.55\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"Nordc-APP-ADFS1.wayne.com\",\"event_data\":{\"param1\":\"68d0163a-b68e-43a0-be66-ac6f0fd72a1f\",\"param2\":\"<?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?>\\n<AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"AppTokenAudit\\\">\\n  <AuditType>AppToken</AuditType>\\n  <AuditResult>Success</AuditResult>\\n  <FailureType>None</FailureType>\\n  <ErrorCode>N/A</ErrorCode>\\n  <ContextComponents>\\n    <Component xsi:type=\\\"ResourceAuditComponent\\\">\\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\\n      <UserId>MDS-ATL\\\\singlesource</UserId>\\n    </Component>\\n    <Component xsi:type=\\\"AuthNAuditComponent\\\">\\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\\n      <DeviceAuth>false</DeviceAuth>\\n      <DeviceId>N/A</DeviceId>\\n      <MfaPerformed>false</MfaPerformed>\\n      <MfaMethod>N/A</MfaMethod>\\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\\n      <TokenBindingReferredId>false</TokenBindingReferredId>\\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\\n    </Component>\\n    <Component xsi:type=\\\"ProtocolAuditComponent\\\">\\n      <OAuthClientId>N/A</OAuthClientId>\\n      <OAuthGrant>N/A</OAuthGrant>\\n    </Component>\\n    <Component xsi:type=\\\"RequestAuditComponent\\\">\\n      <Server>http://adfs.wayne.com/adfs/services/trust</Server>\\n      <AuthProtocol>N/A</AuthProtocol>\\n      <NetworkLocation>Intranet</NetworkLocation>\\n      <IpAddress>192.168.14.46</IpAddress>\\n      <ForwardedIpAddress />\\n      <ProxyIpAddress>N/A</ProxyIpAddress>\\n      <NetworkIpAddress>N/A</NetworkIpAddress>\\n      <ProxyServer>N/A</ProxyServer>\\n      <UserAgentString>N/A</UserAgentString>\\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\\n    </Component>\\n  </ContextComponents>\\n</AuditBase>\"},\"event_id\":\"1200\",\"keywords\":[\"Classic\",\"Audit Success\"],\"provider_name\":\"AD FS Auditing\",\"record_id\":1388401591,\"user\":{\"domain\":\"MDS-ATL\",\"identifier\":\"S-1-5-21-1725571127-999974082-2044928816-27902\",\"name\":\"adfs\",\"type\":\"User\"}}}",
    "messageType": "1200",
    "senderHost": "192.168.10.55",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "ad fs auditing",
    "tags": [
        "v8",
        "eventId:1200",
        "ad fs auditing",
        "1200"
    ],
    "vendorCode": "1388401591"
}