WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T16:55:39.020Z","agent":{"ephemeral_id":"1a816226-5520-4d19-9f0a-910bd50c2191","id":"c6a28f12-5e1b-489b-b0d6-dae12936f03e","name":"TS02-2016","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"WinSqmUserLogin","code":"7001","created":"2024-07-26T16:55:40.274Z","kind":"event","provider":"Microsoft-Windows-Winlogon"},"host":{"name":"TS02-2016.stark.com"},"log":{"level":"information"},"message":"User Logon Notification for Customer Experience Improvement Program","organization":"stark","senderHost":"NORDC-SXESTAGE0.stark.com","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"System","computer_name":"TS02-2016.stark.com","event_data":{"TSId":"14","UserSid":"S-1-5-21-1725571127-999974082-2044928816-26186"},"event_id":"7001","keywords":["ms:Telemetry"],"opcode":"Info","process":{"pid":13664,"thread":{"id":11148}},"provider_guid":"{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}","provider_name":"Microsoft-Windows-Winlogon","record_id":167160,"task":"WinSqmUserLogin","user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
{
    "action": "WinSqmUserLogin",
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T16:55:39.020Z\",\"agent\":{\"ephemeral_id\":\"1a816226-5520-4d19-9f0a-910bd50c2191\",\"id\":\"c6a28f12-5e1b-489b-b0d6-dae12936f03e\",\"name\":\"TS02-2016\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"WinSqmUserLogin\",\"code\":\"7001\",\"created\":\"2024-07-26T16:55:40.274Z\",\"kind\":\"event\",\"provider\":\"Microsoft-Windows-Winlogon\"},\"host\":{\"name\":\"TS02-2016.stark.com\"},\"log\":{\"level\":\"information\"},\"message\":\"User Logon Notification for Customer Experience Improvement Program\",\"organization\":\"stark\",\"senderHost\":\"NORDC-SXESTAGE0.stark.com\",\"sensitivity\":\"normal\",\"winlog\":{\"api\":\"wineventlog\",\"channel\":\"System\",\"computer_name\":\"TS02-2016.stark.com\",\"event_data\":{\"TSId\":\"14\",\"UserSid\":\"S-1-5-21-1725571127-999974082-2044928816-26186\"},\"event_id\":\"7001\",\"keywords\":[\"ms:Telemetry\"],\"opcode\":\"Info\",\"process\":{\"pid\":13664,\"thread\":{\"id\":11148}},\"provider_guid\":\"{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}\",\"provider_name\":\"Microsoft-Windows-Winlogon\",\"record_id\":167160,\"task\":\"WinSqmUserLogin\",\"user\":{\"domain\":\"NT AUTHORITY\",\"identifier\":\"S-1-5-18\",\"name\":\"SYSTEM\",\"type\":\"User\"}}}",
    "messageType": "7001",
    "senderHost": "NORDC-SXESTAGE0.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "microsoft-windows-winlogon",
    "tags": [
        "v8",
        "eventId:7001",
        "microsoft-windows-winlogon",
        "7001"
    ],
    "vendorCode": "167160"
}