WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=153.119.27.209 ::: message={"access_device":{"epkey":"EPDXBLJ8K9AZH0C8FHXN","hostname":null,"ip":"153.119.27.209","location":{"city":"Canton","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"153.119.27.209","key":"DPTIGVJ7TGNIMXPJM0GY","location":{"city":"Canton","country":"United States","state":"Georgia"},"name":"678-984-7259"},"email":"fish@acmeutilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-09-12T12:51:20.191148+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1694523080,"trusted_endpoint_status":"unknown","txid":"5f887b2f-41b3-4bd3-b1b0-4c72857d00dd","user":{"groups":[],"key":"DU53XMH4GKEFQB4ULO2F","name":"fish"}} ::: clientIP=153.119.27.209 ::: userName=fish ::: created_at=1694523080 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1694523080 ::: clientHostname=678-984-7259 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 678-984-7259
localip: 73.184.173.97
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1694523080
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 153.119.27.209
userName: fish