WitFoo-Artifact ::: tags=["result=success","reason=user_approved"] ::: localIP=35.29.254.156 ::: message={"access_device":{"epkey":"EPF4N8W2MWQX64FXR8KR","hostname":null,"ip":"35.29.254.156","location":{"city":"Mt. Pleasant","country":"United States","state":"South Carolina"}},"alias":"","application":{"key":"DI5NR1TYEZ6N0Y46F8AN","name":"LastPass"},"auth_device":{"ip":"35.29.254.156","key":"DPSH5S416UGQQL9GWA6G","location":{"city":"Mt. Pleasant","country":"United States","state":"South Carolina"},"name":"412-370-9347"},"email":"alice@wayneutilities.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2023-09-13T23:13:45.597505+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1694646825,"trusted_endpoint_status":"unknown","txid":"2f94e489-0aa5-4d34-bb40-8aebbd3890a7","user":{"groups":[],"key":"DUJCLW3N9SAXF4WG6Y0A","name":"alice"}} ::: clientIP=35.29.254.156 ::: userName=alice ::: created_at=1694646825 ::: streamName=DUO ::: application=LastPass ::: messageType=credential_access ::: pipelineName=DUO ::: severityCode=2 ::: startTimeUTC=1694646825 ::: clientHostname=412-370-9347 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called DUO by DUO. The following fields were extracted from the message:
application: LastPass
clienthostname: 412-370-9347
localip: 45.27.19.39
messagetype: credential_access
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 1694646825
tags: ['result=success', 'reason=user_approved', 'DUO', 'credential_access']
streamName: DUO
clientIP: 35.29.254.156
userName: alice