WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2022-08-03T05:16:41.040Z","agent":{"ephemeral_id":"54f9c4d3-b89b-418e-9563-3a37a2649e9b","id":"c1a9836f-a0ae-477f-9125-47ef8fc5a674","name":"AWeb02","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-08-03T05:16:42.247Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"AWeb02"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tfish\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","organization":"ACME (acme.acmecloud.com)","senderHost":"10.0.0.102","sensitivity":"normal","winlog":{"activity_id":"{045ccd7e-4fd8-4bf2-942e-d5b11946ce73}","api":"wineventlog","channel":"Security","computer_name":"AWeb02","event_data":{"PrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","SubjectUserName":"fish","SubjectUserSid":"S-1-5-18"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":712,"thread":{"id":812}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":2721084,"task":"Special Logon"}}
This is a syslog message from a product called Windows Active Directory by Microsoft. The following fields were extracted from the message:
senderhost: 10.0.0.102
severitylabel: Info
tags: ['v8', 'eventId:4672', 'microsoft-windows-security-auditing', 'security_privilege_change']
productids: [43]
sourceinfo: unknown
sensitivity: normal
messagetype: security_privilege_change
vendorcode: 2721084
action: Special Logon
streamName: microsoft-windows-security-auditing
userName: fish