WitFoo-Artifact ::: streamName=DUO Asset Inventory ::: tags=[remembered_device] ::: messageType=auth_success ::: message={"access_device":{"browser":"DuoWinLogon","browser_version":"4.2.0","epkey":null,"flash_version":null,"hostname":"L-6QB3FS3","ip":"0.0.0.0","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":"Windows","os_version":"10.0.19045.4651"},"adaptive_trust_assessments":{},"alias":"unknown","application":{"key":"DIR75ZP575GMX3E3CEZE","name":"Microsoft RDP"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":null,"event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T18:42:11.000000+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","result":"success","timestamp":1722019331,"trusted_endpoint_status":"unknown","txid":"1235741e-52ae-4640-9ed3-42575d51e9c1","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DUEASTEH6FR7JG4DO9V9","name":"sarnett"}} ::: program=cisco_duo
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: auth_success
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['remembered_device', 'DUO Asset Inventory', 'auth_success']