WitFoo-Artifact ::: message={"alias1":"cgates","alias2":null,"alias3":null,"alias4":null,"aliases":{"alias1":"cgates"},"created":1471013072,"desktoptokens":[],"email":"nighthawk","enable_auto_prompt":true,"firstname":"","groups":[],"is_enrolled":true,"last_directory_sync":null,"last_login":1721933161,"lastname":"","lockout_reason":null,"notes":"","phones":[{"activated":true,"capabilities":["auto","push","sms","phone","mobile_otp"],"extension":"","last_seen":"2024-07-25T20:22:29","model":"Samsung SM-G990U","name":"","number":"+16782965171","phone_id":"DPVCMGDI3V8RZSDZKVJ2","platform":"Google Android","postdelay":"","predelay":"","sms_passcodes_sent":false,"type":"Mobile"}],"realname":"Chad Gates","status":"active","tokens":[],"u2ftokens":[],"user_id":"DU1FUSBDLA1TT6M87K2A","username":"!cgates","webauthncredentials":[]} ::: userName=nighthawk ::: messageType=asset_inventory ::: streamName=DUO Asset Inventory ::: program=cisco_duo
{
    "fieldExtractorName": "custom_artifact",
    "message": "WitFoo-Artifact ::: message={\"alias1\":\"cgates\",\"alias2\":null,\"alias3\":null,\"alias4\":null,\"aliases\":{\"alias1\":\"cgates\"},\"created\":1471013072,\"desktoptokens\":[],\"email\":\"nighthawk\",\"enable_auto_prompt\":true,\"firstname\":\"\",\"groups\":[],\"is_enrolled\":true,\"last_directory_sync\":null,\"last_login\":1721933161,\"lastname\":\"\",\"lockout_reason\":null,\"notes\":\"\",\"phones\":[{\"activated\":true,\"capabilities\":[\"auto\",\"push\",\"sms\",\"phone\",\"mobile_otp\"],\"extension\":\"\",\"last_seen\":\"2024-07-25T20:22:29\",\"model\":\"Samsung SM-G990U\",\"name\":\"\",\"number\":\"+16782965171\",\"phone_id\":\"DPVCMGDI3V8RZSDZKVJ2\",\"platform\":\"Google Android\",\"postdelay\":\"\",\"predelay\":\"\",\"sms_passcodes_sent\":false,\"type\":\"Mobile\"}],\"realname\":\"Chad Gates\",\"status\":\"active\",\"tokens\":[],\"u2ftokens\":[],\"user_id\":\"DU1FUSBDLA1TT6M87K2A\",\"username\":\"!cgates\",\"webauthncredentials\":[]} ::: userName=nighthawk ::: messageType=asset_inventory ::: streamName=DUO Asset Inventory ::: program=cisco_duo",
    "messageType": "asset_inventory",
    "program": "cisco_duo",
    "senderHost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "DUO Asset Inventory",
    "tags": [
        "DUO Asset Inventory",
        "asset_inventory"
    ],
    "userName": "nighthawk"
}