WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T19:43:19.929Z","agent":{"ephemeral_id":"79c234b3-7334-47be-ace5-d5a086b51b81","id":"43c4e05b-88a7-463f-986d-cf6c6c847020","name":"NORDC-APP-LAT6","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"8222","created":"2024-07-26T19:43:21.080Z","kind":"event","outcome":"success","provider":"VSSAudit"},"host":{"name":"NORDC-APP-LAT6.oscorp.com"},"log":{"level":"information"},"message":"Shadow copy has been created.\n \n User SID:\t\t\tS-1-5-18\n User name:\t\t\tNT AUTHORITY\\SYSTEM\n Process ID:\t\t\t0x00000000000025a0\n Process image name:\t\tC:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe\n \n Shadow Set ID:\t\t\t{8fbd2f71-825c-498d-8c45-8a210d256a95}\n Shadow ID:\t\t\t{ba4b5044-573f-4cc4-948e-89235c863821}\n Provider ID:\t\t\t{b5946137-7b9f-4925-af80-51abd60b20d5}\n Original Moscorpine:\t\tNORDC-APP-LAT6.oscorp.com\n Original Volume:\t\t\t\\\\?\\Volume{6809cd7e-0000-0000-0000-500600000000}\\\n Shadow device name:\t\t\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2189","organization":"oscorp","senderHost":"NORDC-APP-LAT6.oscorp.com","sensitivity":"normal","winlog":{"activity_id":"{533ae33c-de5a-483d-8439-7939365c52b8}","api":"wineventlog","channel":"Security","computer_name":"NORDC-APP-LAT6.oscorp.com","event_data":{"param1":"S-1-5-18","param10":"\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2189","param2":"NT AUTHORITY\\SYSTEM","param3":"0x00000000000025a0","param4":"C:\\Program Files\\SentinelOne\\Sentinel Agent 23.3.3.264\\SentinelAgent.exe","param5":"{8fbd2f71-825c-498d-8c45-8a210d256a95}","param6":"{ba4b5044-573f-4cc4-948e-89235c863821}","param7":"{b5946137-7b9f-4925-af80-51abd60b20d5}","param8":"NORDC-APP-LAT6.oscorp.com","param9":"\\\\?\\Volume{6809cd7e-0000-0000-0000-500600000000}\\"},"event_id":"8222","keywords":["Audit Success","Classic"],"opcode":"Info","process":{"pid":752,"thread":{"id":6296}},"provider_name":"VSSAudit","record_id":4044025,"user":{"domain":"NT AUTHORITY","identifier":"S-1-5-18","name":"SYSTEM","type":"User"}}}
{
    "fieldExtractorName": "winlogbeat",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-26T19:43:19.929Z\",\"agent\":{\"ephemeral_id\":\"79c234b3-7334-47be-ace5-d5a086b51b81\",\"id\":\"43c4e05b-88a7-463f-986d-cf6c6c847020\",\"name\":\"NORDC-APP-LAT6\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"code\":\"8222\",\"created\":\"2024-07-26T19:43:21.080Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"VSSAudit\"},\"host\":{\"name\":\"NORDC-APP-LAT6.oscorp.com\"},\"log\":{\"level\":\"information\"},\"message\":\"Shadow copy has been created.\\n \\n User SID:\\t\\t\\tS-1-5-18\\n User name:\\t\\t\\tNT AUTHORITY\\\\SYSTEM\\n Process ID:\\t\\t\\t0x00000000000025a0\\n Process image name:\\t\\tC:\\\\Program Files\\\\SentinelOne\\\\Sentinel Agent 23.3.3.264\\\\SentinelAgent.exe\\n \\n Shadow Set ID:\\t\\t\\t{8fbd2f71-825c-498d-8c45-8a210d256a95}\\n Shadow ID:\\t\\t\\t{ba4b5044-573f-4cc4-948e-89235c863821}\\n Provider ID:\\t\\t\\t{b5946137-7b9f-4925-af80-51abd60b20d5}\\n Original Moscorpine:\\t\\tNORDC-APP-LAT6.oscorp.com\\n Original Volume:\\t\\t\\t\\\\\\\\?\\\\Volume{6809cd7e-0000-0000-0000-500600000000}\\\\\\n Shadow device name:\\t\\t\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy2189\",\"organization\":\"oscorp\",\"senderHost\":\"NORDC-APP-LAT6.oscorp.com\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{533ae33c-de5a-483d-8439-7939365c52b8}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"NORDC-APP-LAT6.oscorp.com\",\"event_data\":{\"param1\":\"S-1-5-18\",\"param10\":\"\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy2189\",\"param2\":\"NT AUTHORITY\\\\SYSTEM\",\"param3\":\"0x00000000000025a0\",\"param4\":\"C:\\\\Program Files\\\\SentinelOne\\\\Sentinel Agent 23.3.3.264\\\\SentinelAgent.exe\",\"param5\":\"{8fbd2f71-825c-498d-8c45-8a210d256a95}\",\"param6\":\"{ba4b5044-573f-4cc4-948e-89235c863821}\",\"param7\":\"{b5946137-7b9f-4925-af80-51abd60b20d5}\",\"param8\":\"NORDC-APP-LAT6.oscorp.com\",\"param9\":\"\\\\\\\\?\\\\Volume{6809cd7e-0000-0000-0000-500600000000}\\\\\"},\"event_id\":\"8222\",\"keywords\":[\"Audit Success\",\"Classic\"],\"opcode\":\"Info\",\"process\":{\"pid\":752,\"thread\":{\"id\":6296}},\"provider_name\":\"VSSAudit\",\"record_id\":4044025,\"user\":{\"domain\":\"NT AUTHORITY\",\"identifier\":\"S-1-5-18\",\"name\":\"SYSTEM\",\"type\":\"User\"}}}",
    "messageType": "8222",
    "senderHost": "NORDC-APP-LAT6.mingledorffs.com",
    "sensitivity": "normal",
    "severityLabel": "Info",
    "sourceInfo": "unknown",
    "streamName": "vssaudit",
    "tags": [
        "v8",
        "eventId:8222",
        "vssaudit",
        "8222"
    ],
    "vendorCode": "4044025"
}