WitFoo-Artifact ::: messageType=auth_failure ::: program=okta ::: clientIP=135.15.159.233 ::: action=FAILURE ::: message={"actor":{"alternateId":"janedoe","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxMgjuDBXvR6aIYX9gqrEUyw","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":33.9889,"lon":-118.153},"postalCode":"90040","state":"California"},"id":null,"ipAddress":"135.15.159.233","userAgent":{"browser":"EDGE","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs06a.auw2-ok14.internal//1707496560985//24cfbc9a6e181123423137bcb8a4c4e0:fb9ec261-0238-449e-ad41-925b553d88fa:","agentid":"a532lo6a4sAZS1Lht697","authnRequestId":"4f7514edc534c4c6344273390db30098","delauthtimeout":"4000","delauthtimespentatagent":"31","delauthtimespentatdomaincontroller":"31","delauthtimetotal":"127","deviceFingerprint":"0f3059776c95ddb5ba1a4df5b2f92338","dtHash":"a9efeac6312750506b33308bf98e74147223cbc5fc029d30ee0c12e9de31069b","errorCode":"1326","requestId":"24cfbc9a6e181123423137bcb8a4c4e0","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T16:35:57.113Z","request":{"ipChain":[{"geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":33.9889,"lon":-118.153},"postalCode":"90040","state":"California"},"ip":"135.15.159.233","source":null,"version":"V4"}]},"securityContext":{"asNumber":3356,"asOrg":"level 3 parent  llc","domain":"level3.net","isProxy":false,"isp":"level 3 parent  llc"},"severity":"ERROR","target":[{"alternateId":"mtran@umbrella.bank","detailEntry":null,"displayName":"Michael Tran","id":"0ua6l1q0bdrZCI71p697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"24cfbc9a6e181123423137bcb8a4c4e0","type":"WEB"},"uuid":"4cec92a2-c769-11ee-b70d-6559e2257218","version":"0"} ::: severityCode=2 ::: streamName=Okta ::: userName=janedoe ::: severityLabel=ERROR
This is a syslog message from a product called Okta by Okta. The following fields were extracted from the message:
action: FAILURE
messagetype: auth_failure
productids: [6]
program: okta
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
tags: ['Okta', 'auth_failure']
streamName: Okta
clientIP: 135.15.159.233
userName: janedoe