WitFoo-Artifact ::: streamName=DUO Asset Inventory ::: messageType=asset_inventory ::: program=cisco_duo ::: message={"alias1":"jbetro","alias2":"fish","alias3":"jbetro@wayneutilities.com","alias4":null,"aliases":{"alias1":"jbetro","alias2":"fish","alias3":"jbetro@wayneutilities.com"},"created":1471360467,"desktoptokens":[],"email":"fish","enable_auto_prompt":true,"firstname":"","groups":[{"desc":"Users that are allowed to run pipelines within Azure DevOps that affect production environments","group_id":"DGUE0C69WGYPJGJ3F3HW","mobile_otp_enabled":false,"name":"Azure DevOps PRD Pipelines","push_enabled":false,"sms_enabled":false,"status":"Active","voice_enabled":false}],"is_enrolled":true,"last_directory_sync":null,"last_login":1722252647,"lastname":"","lockout_reason":null,"notes":"","phones":[{"activated":true,"capabilities":["auto","push","sms","phone","mobile_otp"],"extension":"","last_seen":"2024-07-29T11:30:45","model":"Samsung SM-S901U1","name":"phone2","number":"+13145371336","phone_id":"DP0W9R0H7R0WJ4GY2HK8","platform":"Google Android","postdelay":"0","predelay":"0","sms_passcodes_sent":true,"type":"Mobile"}],"realname":"Jeff Betro","status":"active","tokens":[],"u2ftokens":[],"user_id":"DUCOEHG5PIQG8MF7JIQ7","username":"!jbetro","webauthncredentials":[]} ::: userName=fish
This is a syslog message from a product called Duo by Cisco. The following fields were extracted from the message:
fieldExtractorName: custom_artifact
messageType: asset_inventory
program: cisco_duo
senderHost: kafka.precinct
sensitivity: normal
sourceInfo: unknown
streamName: DUO Asset Inventory
tags: ['DUO Asset Inventory', 'asset_inventory']
userName: fish