WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=237.124.202.41 ::: message={"access_device":{"epkey":"EPI1I4T0LAX9P1650PY4","hostname":null,"ip":"237.124.202.41","location":{"city":"Suwanee","country":"United States","state":"Georgia"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"237.124.202.41","key":"DPSIKHUSM0JIU4Y2CSCH","location":{"city":"Suwanee","country":"United States","state":"Georgia"},"name":"678-232-3375"},"email":"alice@umbrellaelectric.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-04-12T14:40:39.914358+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1681310439,"txid":"35c97ab1-798b-41a7-ba4f-db56610a2c9e","user":{"groups":[],"key":"DU46KG199M41WHFC7M4K","name":"alice"}} ::: clientIP=237.124.202.41 ::: userName=alice ::: created_at=1681310439 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1681310439 ::: clientHostname=678-232-3375 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
senderhost: localhost
severitylabel: critical
starttimeutc: 1681310439
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
productids: [0]
severitycode: 2
sourceinfo: unknown
localip: 75.63.121.145
sensitivity: normal
application: LastPass
messagetype: credential_access
clienthostname: 678-232-3375
streamName: DUO
clientIP: 237.124.202.41
userName: alice