<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4776</EventID><Version>0</Version><Level>0</Level><Task>14336</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-26T20:28:30.527989900Z'/><EventRecordID>16233129</EventRecordID><Correlation/><Execution ProcessID='632' ThreadID='5504'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.umbrellaint.com</Computer><Security/></System><EventData><Data Name='PackageName'>MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data><Data Name='TargetUserName'>johndoe</Data><Data Name='Workstation'>NCASALTPRDAPP01</Data><Data Name='Status'>0x0</Data></EventData><RenderingInfo Culture='en-US'><Message>The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	johndoe
Source Workstation:	NCASALTPRDAPP01
Error Code:	0x0</Message><Level>Information</Level><Task>Credential Validation</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
{
    "fieldExtractorName": "windows_security_audit_xml",
    "message": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4776</EventID><Version>0</Version><Level>0</Level><Task>14336</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-26T20:28:30.527989900Z'/><EventRecordID>16233129</EventRecordID><Correlation/><Execution ProcessID='632' ThreadID='5504'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.umbrellaint.com</Computer><Security/></System><EventData><Data Name='PackageName'>MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data><Data Name='TargetUserName'>johndoe</Data><Data Name='Workstation'>NCASALTPRDAPP01</Data><Data Name='Status'>0x0</Data></EventData><RenderingInfo Culture='en-US'><Message>The computer attempted to validate the credentials for an account.\r\n\r\nAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\nLogon Account:\tjohndoe\r\nSource Workstation:\tNCASALTPRDAPP01\r\nError Code:\t0x0</Message><Level>Information</Level><Task>Credential Validation</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>",
    "messageType": "security_audit_event",
    "senderHost": "10.168.2.135-SecurityEvents",
    "sensitivity": "normal",
    "serverHostname": "IP-C61302E6.prdnca.paygoint.com",
    "sourceInfo": "unknown",
    "streamName": "windows_security_audit",
    "tags": [
        "eventId:4776",
        "windows_security_audit",
        "security_audit_event"
    ],
    "userName": "johndoe"
}