WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-27T05:02:06.228Z","agent":{"ephemeral_id":"1944c580-06d8-4390-a7cb-86ba1b035035","id":"2a9c3fad-c33e-4316-92c6-e07c9b6c59a1","name":"NORDC-SS1-PWEB","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-27T05:02:06.835Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-SS1-PWEB.acme.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x0000000000002e88\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{80d8afa2-d513-4fdb-9145-a44884d21b28}\n Shadow ID:\t\t\t{ee982af5-9809-43b2-beb0-e0b0479c1d20}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Macmeine:\t\tNORDC-SS1-PWEB.acme.com\n Original Volume:\t\t\t\\\\?\\Volume{476fecea-0000-0000-0000-100000000000}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1673","organization":"acme","senderHost":"NORDC-SS1-PWEB.acme.com","sensitivity":"normal","winlog":{"activity_id":"{0d2e9d69-73cb-0001-619e-2e0dcb73da01}","api":"wineventlog","channel":"Security","computer_name":"NORDC-SS1-PWEB.acme.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1673","param2":"NT AUTHORITY\\SYSTEM","param3":"0x0000000000002e88","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{80d8afa2-d513-4fdb-9145-a44884d21b28}","param6":"{ee982af5-9809-43b2-beb0-e0b0479c1d20}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-SS1-PWEB.acme.com","param9":"\\\\?\\Volume{476fecea-0000-0000-0000-100000000000}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","process":{"pid":748,"thread":{"id":7232}},"provider_name":"VSSAudit","record_id":84468279,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
This is a syslog message from a product called vssaudit by vssaudit. The following fields were extracted from the message:
fieldExtractorName: winlogbeat
messageType: 8222
senderHost: NORDC-SS1-PWEB.mingledorffs.com
sensitivity: normal
severityLabel: Info
sourceInfo: unknown
streamName: vssaudit
tags: ['v8', 'eventId:8222', 'vssaudit', '8222']
vendorCode: 84468279