WitFoo-Artifact ::: streamName=DUO Asset Inventory ::: messageType=auth_success ::: tags=[remembered_device] ::: message={"access_device":{"browser":"Chrome","browser_version":"126.0.6478.185","epkey":"EPOZHVQKMVG7C0MWPTMC","flash_version":"uninstalled","hostname":null,"ip":"69.234.139.26","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Powder Springs","country":"United States","state":"Georgia"},"os":"Windows","os_version":"11"},"adaptive_trust_assessments":{"more_secure_auth":{"detected_attack_detectors":null,"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"preview_mode_enabled":false,"reason":"Normal level of trust; no detection of known attack pattern","trust_level":"NORMAL"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Known Access IP","trust_level":"NORMAL"}},"alias":"","application":{"key":"DIK6UXC7JCVKZD6LJEQG","name":"OEA - Production (Duo SSO)"},"auth_device":{"ip":null,"key":null,"location":{"city":null,"country":null,"state":null},"name":null},"email":"janedoe","event_type":"authentication","factor":"remembered_device","isotimestamp":"2024-07-26T11:47:09.462976+00:00","ood_software":null,"rbfs_triggered_attacks":null,"reason":"remembered_device","remembered_factor":"duo_push","result":"success","timestamp":1721994429,"trusted_endpoint_status":"unknown","txid":"32ab9540-d1f0-4a44-9f47-ccc29881ff64","user":{"groups":["DuoUsers (from AD sync \"AD Sync\")"],"key":"DUWX1F4FKTG4ABN9E4QM","name":"jfern"}} ::: program=cisco_duo ::: userName=janedoe
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: auth_success
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['remembered_device', 'DUO Asset Inventory', 'auth_success']
userName: janedoe