WitFoo-Artifact ::: messageType=auth_failure ::: program=okta ::: clientIP=206.197.222.115 ::: action=FAILURE ::: message={"actor":{"alternateId":"johndoe","detailEntry":null,"displayName":"Okta System","id":"spr16ygr5qFPw1bhs697","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":"ACTIVE_DIRECTORY","authenticationStep":0,"credentialProvider":null,"credentialType":"PASSWORD","externalSessionId":"idxMgjuDBXvR6aIYX9gqrEUyw","interface":"AD APP Instance","issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":33.9889,"lon":-118.153},"postalCode":"90040","state":"California"},"id":null,"ipAddress":"206.197.222.115","userAgent":{"browser":"EDGE","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045"},"zone":"null"},"debugContext":{"debugData":{"actionid":"rpc::app.active_directory.agent.reply.ok14-majorecs06a.auw2-ok14.internal//1707496560985//24cfbc9a6e181123423137bcb8a4c4e0:fb9ec261-0238-449e-ad41-925b553d88fa:","agentid":"a532lo6a4sAZS1Lht697","authnRequestId":"4f7514edc534c4c6344273390db30098","delauthtimeout":"4000","delauthtimespentatagent":"31","delauthtimespentatdomaincontroller":"31","delauthtimetotal":"127","deviceFingerprint":"0f3059776c95ddb5ba1a4df5b2f92338","dtHash":"a9efeac6312750506b33308bf98e74147223cbc5fc029d30ee0c12e9de31069b","errorCode":"1326","requestId":"24cfbc9a6e181123423137bcb8a4c4e0","requestUri":"/idp/idx/identify","threatSuspected":"false","url":"/idp/idx/identify?"}},"device":null,"displayMessage":"Authenticate user with AD agent","eventType":"user.authentication.auth_via_AD_agent","legacyEventType":"app.ad.login.bad_password","outcome":{"reason":"Authentication failed: bad username or password","result":"FAILURE"},"published":"2024-02-09T16:35:57.113Z","request":{"ipChain":[{"geographicalContext":{"city":"Los Angeles","country":"United States","geolocation":{"lat":33.9889,"lon":-118.153},"postalCode":"90040","state":"California"},"ip":"206.197.222.115","source":null,"version":"V4"}]},"securityContext":{"asNumber":3356,"asOrg":"level 3 parent  llc","domain":"level3.net","isProxy":false,"isp":"level 3 parent  llc"},"severity":"ERROR","target":[{"alternateId":"mtran@oscorp.bank","detailEntry":null,"displayName":"Michael Tran","id":"0ua6l1q0bdrZCI71p697","type":"AppUser"},{"alternateId":"SDPB.LOCAL","detailEntry":null,"displayName":"Active Directory","id":"0oa16yxhp6iUzuI2b697","type":"AppInstance"}],"transaction":{"detail":{},"id":"24cfbc9a6e181123423137bcb8a4c4e0","type":"WEB"},"uuid":"4cec92a2-c769-11ee-b70d-6559e2257218","version":"0"} ::: severityCode=2 ::: streamName=Okta ::: userName=johndoe ::: severityLabel=ERROR
{
    "action": "FAILURE",
    "message": "WitFoo-Artifact ::: messageType=auth_failure ::: program=okta ::: clientIP=206.197.222.115 ::: action=FAILURE ::: message={\"actor\":{\"alternateId\":\"johndoe\",\"detailEntry\":null,\"displayName\":\"Okta System\",\"id\":\"spr16ygr5qFPw1bhs697\",\"type\":\"SystemPrincipal\"},\"authenticationContext\":{\"authenticationProvider\":\"ACTIVE_DIRECTORY\",\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":\"PASSWORD\",\"externalSessionId\":\"idxMgjuDBXvR6aIYX9gqrEUyw\",\"interface\":\"AD APP Instance\",\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Los Angeles\",\"country\":\"United States\",\"geolocation\":{\"lat\":33.9889,\"lon\":-118.153},\"postalCode\":\"90040\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"206.197.222.115\",\"userAgent\":{\"browser\":\"EDGE\",\"os\":\"Windows 10\",\"rawUserAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"actionid\":\"rpc::app.active_directory.agent.reply.ok14-majorecs06a.auw2-ok14.internal//1707496560985//24cfbc9a6e181123423137bcb8a4c4e0:fb9ec261-0238-449e-ad41-925b553d88fa:\",\"agentid\":\"a532lo6a4sAZS1Lht697\",\"authnRequestId\":\"4f7514edc534c4c6344273390db30098\",\"delauthtimeout\":\"4000\",\"delauthtimespentatagent\":\"31\",\"delauthtimespentatdomaincontroller\":\"31\",\"delauthtimetotal\":\"127\",\"deviceFingerprint\":\"0f3059776c95ddb5ba1a4df5b2f92338\",\"dtHash\":\"a9efeac6312750506b33308bf98e74147223cbc5fc029d30ee0c12e9de31069b\",\"errorCode\":\"1326\",\"requestId\":\"24cfbc9a6e181123423137bcb8a4c4e0\",\"requestUri\":\"/idp/idx/identify\",\"threatSuspected\":\"false\",\"url\":\"/idp/idx/identify?\"}},\"device\":null,\"displayMessage\":\"Authenticate user with AD agent\",\"eventType\":\"user.authentication.auth_via_AD_agent\",\"legacyEventType\":\"app.ad.login.bad_password\",\"outcome\":{\"reason\":\"Authentication failed: bad username or password\",\"result\":\"FAILURE\"},\"published\":\"2024-02-09T16:35:57.113Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Los Angeles\",\"country\":\"United States\",\"geolocation\":{\"lat\":33.9889,\"lon\":-118.153},\"postalCode\":\"90040\",\"state\":\"California\"},\"ip\":\"206.197.222.115\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":3356,\"asOrg\":\"level 3 parent  llc\",\"domain\":\"level3.net\",\"isProxy\":false,\"isp\":\"level 3 parent  llc\"},\"severity\":\"ERROR\",\"target\":[{\"alternateId\":\"mtran@oscorp.bank\",\"detailEntry\":null,\"displayName\":\"Michael Tran\",\"id\":\"0ua6l1q0bdrZCI71p697\",\"type\":\"AppUser\"},{\"alternateId\":\"SDPB.LOCAL\",\"detailEntry\":null,\"displayName\":\"Active Directory\",\"id\":\"0oa16yxhp6iUzuI2b697\",\"type\":\"AppInstance\"}],\"transaction\":{\"detail\":{},\"id\":\"24cfbc9a6e181123423137bcb8a4c4e0\",\"type\":\"WEB\"},\"uuid\":\"4cec92a2-c769-11ee-b70d-6559e2257218\",\"version\":\"0\"} ::: severityCode=2 ::: streamName=Okta ::: userName=johndoe ::: severityLabel=ERROR",
    "messagetype": "auth_failure",
    "productids": [
        6
    ],
    "program": "okta",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "tags": [
        "Okta",
        "auth_failure"
    ],
    "streamName": "Okta",
    "clientIP": "206.197.222.115",
    "userName": "johndoe"
}