WitFoo-Artifact ::: tags=[os=Ubuntu 22.04,last_seen=2024-07-29T22:49:18Z,hardware_product=c6a.2xlarge,hardware_manufacturer=Amazon EC2] ::: clientIP=232.60.218.23 ::: clientHostname=NVIMGTWIT01 ::: message={"agent_load_flags":"0","agent_local_time":"2024-07-20T06:00:32.475Z","agent_version":"7.17.17005.0","bios_manufacturer":"Amazon EC2","bios_version":"1.0","chassis_type":"1","chassis_type_desc":"Other","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"17005","config_id_platform":"8","connection_ip":"232.60.218.23","connection_mac_address":"0a-44-a8-36-80-91","cpu_signature":"10489617","cpu_vendor":"1","default_gateway_ip":"10.240.6.1","deployment_type":"Standard","device_id":"8959a94a4a0f420d94b47c0b912125ed","device_policies":{"fim":{"applied":true,"applied_date":"2024-04-12T00:04:26.799562818Z","assigned_date":"2024-04-12T00:02:12.417434088Z","policy_id":"18bc7bad59ff40e48212debaafa69be7","policy_type":"fim","settings_hash":"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6"},"global_config":{"applied":true,"applied_date":"2024-07-20T06:02:22.066083273Z","assigned_date":"2024-07-20T06:00:44.061224216Z","policy_id":"342bff7c15ef474a8eb7e6635b9fddb0","policy_type":"globalconfig","settings_hash":"dc37c277"},"host-retention":{"applied":true,"applied_date":"2024-07-11T22:23:33.764520146Z","assigned_date":"2024-07-11T22:22:30.074895862Z","policy_id":"dcb67963711e4354bbb6c4d6b837e711","policy_type":"host-retention","settings_hash":"fce339fc6cbb4dae36929fe363a81368f4a7e3f2c3a3d62ff7e3ef202ee48df5"},"prevention":{"applied":true,"applied_date":"2024-03-04T19:41:27.683577671Z","assigned_date":"2024-03-04T19:40:34.650570328Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"},"remote_response":{"applied":true,"applied_date":"2024-03-04T19:41:28.36495805Z","assigned_date":"2024-03-04T19:40:34.651027585Z","policy_id":"80fa74fcb9c84b90bed01c4b76a7eaa3","policy_type":"remote-response","settings_hash":"17550b92"},"sensor_update":{"applied":true,"applied_date":"2024-07-19T06:18:56.700617586Z","assigned_date":"2024-07-19T06:17:05.668343356Z","policy_id":"cf70114f29204128b689d83524396e83","policy_type":"sensor-update","settings_hash":";","uninstall_protection":"UNKNOWN"}},"external_ip":"23.20.143.83","filesystem_containment_status":"normal","first_seen":"2024-03-04T19:40:23Z","group_hash":"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9","groups":["8c86687045fc4af494d67259fb834ea6"],"hostname":"NVIMGTWIT01","instance_id":"i-0c0a299e6b72703d5","kernel_version":"6.5.0-1023-aws","last_seen":"2024-07-29T22:49:18Z","linux_sensor_mode":"User Mode","local_ip":"232.60.218.23","mac_address":"0a-44-a8-36-80-91","major_version":"6","meta":{"version":"14478","version_string":"17:90867893393"},"minor_version":"5","modified_timestamp":"2024-07-29T22:50:50Z","os_version":"Ubuntu 22.04","platform_id":"3","platform_name":"Linux","policies":[{"applied":true,"applied_date":"2024-03-04T19:41:27.683577671Z","assigned_date":"2024-03-04T19:40:34.650570328Z","policy_id":"82a27c74ce20486ca00632185172b2a5","policy_type":"prevention","rule_groups":[],"settings_hash":"ca0ab2ab"}],"product_type_desc":"Server","provision_status":"Provisioned","reduced_functionality_mode":"no","serial_number":"ec23f348-71e6-bd11-72f7-7bef8ada4c07","service_provider":"AWS_EC2_V2","service_provider_account_id":"550132162628","status":"normal","system_manufacturer":"Amazon EC2","system_product_name":"c6a.2xlarge","tags":[],"zone_group":"us-east-1a"} ::: streamName=Crowdstrike Asset Inventory ::: messageType=asset_inventory ::: program=crowdstrike_falcon ::: clientGUID=8959a94a4a0f420d94b47c0b912125ed
{
    "clientGUID": "8959a94a4a0f420d94b47c0b912125ed",
    "clientHostname": "NVIMGTWIT01",
    "clientIP": "232.60.218.23",
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: tags=[os=Ubuntu 22.04,last_seen=2024-07-29T22:49:18Z,hardware_product=c6a.2xlarge,hardware_manufacturer=Amazon EC2] ::: clientIP=232.60.218.23 ::: clientHostname=NVIMGTWIT01 ::: message={\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-07-20T06:00:32.475Z\",\"agent_version\":\"7.17.17005.0\",\"bios_manufacturer\":\"Amazon EC2\",\"bios_version\":\"1.0\",\"chassis_type\":\"1\",\"chassis_type_desc\":\"Other\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17005\",\"config_id_platform\":\"8\",\"connection_ip\":\"232.60.218.23\",\"connection_mac_address\":\"0a-44-a8-36-80-91\",\"cpu_signature\":\"10489617\",\"cpu_vendor\":\"1\",\"default_gateway_ip\":\"10.240.6.1\",\"deployment_type\":\"Standard\",\"device_id\":\"8959a94a4a0f420d94b47c0b912125ed\",\"device_policies\":{\"fim\":{\"applied\":true,\"applied_date\":\"2024-04-12T00:04:26.799562818Z\",\"assigned_date\":\"2024-04-12T00:02:12.417434088Z\",\"policy_id\":\"18bc7bad59ff40e48212debaafa69be7\",\"policy_type\":\"fim\",\"settings_hash\":\"923a68bcefc0a9982c46dfde6aa0dc02c411a1031f419e6c7d354eaf0bce69f6\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2024-07-20T06:02:22.066083273Z\",\"assigned_date\":\"2024-07-20T06:00:44.061224216Z\",\"policy_id\":\"342bff7c15ef474a8eb7e6635b9fddb0\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"dc37c277\"},\"host-retention\":{\"applied\":true,\"applied_date\":\"2024-07-11T22:23:33.764520146Z\",\"assigned_date\":\"2024-07-11T22:22:30.074895862Z\",\"policy_id\":\"dcb67963711e4354bbb6c4d6b837e711\",\"policy_type\":\"host-retention\",\"settings_hash\":\"fce339fc6cbb4dae36929fe363a81368f4a7e3f2c3a3d62ff7e3ef202ee48df5\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2024-03-04T19:41:27.683577671Z\",\"assigned_date\":\"2024-03-04T19:40:34.650570328Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2024-03-04T19:41:28.36495805Z\",\"assigned_date\":\"2024-03-04T19:40:34.651027585Z\",\"policy_id\":\"80fa74fcb9c84b90bed01c4b76a7eaa3\",\"policy_type\":\"remote-response\",\"settings_hash\":\"17550b92\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2024-07-19T06:18:56.700617586Z\",\"assigned_date\":\"2024-07-19T06:17:05.668343356Z\",\"policy_id\":\"cf70114f29204128b689d83524396e83\",\"policy_type\":\"sensor-update\",\"settings_hash\":\";\",\"uninstall_protection\":\"UNKNOWN\"}},\"external_ip\":\"23.20.143.83\",\"filesystem_containment_status\":\"normal\",\"first_seen\":\"2024-03-04T19:40:23Z\",\"group_hash\":\"17b219aad5d2076527b396bfd615b141f02061e4c497ec8d3cc5d0f40c3507d9\",\"groups\":[\"8c86687045fc4af494d67259fb834ea6\"],\"hostname\":\"NVIMGTWIT01\",\"instance_id\":\"i-0c0a299e6b72703d5\",\"kernel_version\":\"6.5.0-1023-aws\",\"last_seen\":\"2024-07-29T22:49:18Z\",\"linux_sensor_mode\":\"User Mode\",\"local_ip\":\"232.60.218.23\",\"mac_address\":\"0a-44-a8-36-80-91\",\"major_version\":\"6\",\"meta\":{\"version\":\"14478\",\"version_string\":\"17:90867893393\"},\"minor_version\":\"5\",\"modified_timestamp\":\"2024-07-29T22:50:50Z\",\"os_version\":\"Ubuntu 22.04\",\"platform_id\":\"3\",\"platform_name\":\"Linux\",\"policies\":[{\"applied\":true,\"applied_date\":\"2024-03-04T19:41:27.683577671Z\",\"assigned_date\":\"2024-03-04T19:40:34.650570328Z\",\"policy_id\":\"82a27c74ce20486ca00632185172b2a5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"ca0ab2ab\"}],\"product_type_desc\":\"Server\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"ec23f348-71e6-bd11-72f7-7bef8ada4c07\",\"service_provider\":\"AWS_EC2_V2\",\"service_provider_account_id\":\"550132162628\",\"status\":\"normal\",\"system_manufacturer\":\"Amazon EC2\",\"system_product_name\":\"c6a.2xlarge\",\"tags\":[],\"zone_group\":\"us-east-1a\"} ::: streamName=Crowdstrike Asset Inventory ::: messageType=asset_inventory ::: program=crowdstrike_falcon ::: clientGUID=8959a94a4a0f420d94b47c0b912125ed",
    "messageType": "asset_inventory",
    "program": "crowdstrike_falcon",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "Crowdstrike Asset Inventory",
    "tags": [
        "hardware_manufacturer=Amazon EC2",
        "Crowdstrike Asset Inventory",
        "hardware_product=c6a.2xlarge",
        "os=Ubuntu 22.04",
        "last_seen=2024-07-29T22:49:18Z",
        "asset_inventory"
    ]
}