WitFoo-Artifact ::: userName=johndoe ::: streamName=Microsoft Graph Asset Inventory ::: message={"businessPhones":[],"displayName":"211ClientAsst","givenName":"211ClientAsst","id":"a03b1bb3-02d4-4b24-8270-3decd8882ec2","jobTitle":"Email Account for 211 Client Assistance Forms","mail":"johndoe","mobilePhone":null,"officeLocation":null,"preferredLanguage":null,"surname":null,"userPrincipalName":"johndoe"} ::: messageType=asset_inventory ::: tags=[mail=johndoe,jobTitle=Email Account for 211 Client Assistance Forms,givenName=211ClientAsst,displayName=211ClientAsst] ::: program=microsoft_graph
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: microsoft_graph
senderHost: WitFoo-Streamer2.uwca.org
sensitivity: normal
sourceInfo: unknown
streamName: Microsoft Graph Asset Inventory
tags: ['jobTitle=Email Account for 211 Client Assistance Forms', 'givenName=211ClientAsst', 'displayName=211ClientAsst', 'Microsoft Graph Asset Inventory', 'mail=211clientasst@uwca.org', 'asset_inventory']
userName: johndoe