WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T17:07:11.337Z","agent":{"ephemeral_id":"e8fb59cc-e149-43a7-ab4b-53ab61624426","id":"68d26628-116d-42f1-a6e0-d53dfced01df","name":"NORDC-APP-LATz1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"None","code":"64","created":"2024-07-26T17:07:11.964Z","kind":"event","provider":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment"},"host":{"name":"NORDC-APP-LATz1.stark.com"},"log":{"level":"warning"},"message":"Certificate for local system with Thumbprint 76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb is about to expire or already expired.","organization":"stark","senderHost":"192.168.12.141","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Application","computer_name":"NORDC-APP-LATz1.stark.com","event_data":{"Context":"local system","ObjId":"76 ce 34 dc 36 5f f2 3a 98 93 3a 39 52 54 eb 79 ff 51 b0 cb"},"event_id":"64","keywords":["Classic"],"opcode":"Info","provider_guid":"{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}","provider_name":"Microsoft-Windows-CertificateServicesClient-AutoEnrollment","record_id":182140,"task":"None"}}
This is a syslog message from a product called microsoft-windows-certificateservicesclient-autoenrollment by microsoft-windows-certificateservicesclient-autoenrollment. The following fields were extracted from the message:
action: None
fieldExtractorName: winlogbeat
messageType: 64
senderHost: 192.168.12.141
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: microsoft-windows-certificateservicesclient-autoenrollment
tags: ['v8', 'eventId:64', 'microsoft-windows-certificateservicesclient-autoenrollment', '64']
vendorCode: 182140