WitFoo-Artifact ::: tags=["result=denied","reason=no_response"] ::: localIP=null ::: message={"access_device":{"epkey":"EPV3NW6T8467OMYQ9IPR","hostname":null,"ip":"33.102.57.87","location":{"city":"Lilburn","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":null,"key":"DPPRTBW5G0J28XRGYQST","location":{"city":null,"country":null,"state":null},"name":"404-917-5685"},"email":"fish@wayneutilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-09-14T20:50:40.072852+00:00","ood_software":null,"reason":"no_response","result":"denied","timestamp":1694724640,"trusted_endpoint_status":"unknown","txid":"e96a800f-46ce-41f9-bb8c-27007acf6624","user":{"groups":[],"key":"DUWTELL1DUW9IU6H5DK1","name":"fish"}} ::: clientIP=33.102.57.87 ::: userName=fish ::: created_at=1694724640 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1694724640 ::: clientHostname=404-917-5685 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 404-917-5685
localip: null
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1694724640
tags: ['result=denied', 'reason=no_response', 'DUO', 'credential_access']
streamName: DUO
clientIP: 33.102.57.87
userName: fish