WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-30T10:14:40.387Z","agent":{"ephemeral_id":"a668c636-ec70-4103-9c98-53517f0df854","id":"040c78f0-1741-4108-a30c-aaf00e9af961","name":"NVIPROCPRDWEB01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2024-07-30T10:14:42.297Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"NVIPROCPRDWEB01.prdnvi.acmeint.com"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-855572474-1402847513-2951438033-32165\n\tAccount Name:\t\tprocprd-appuser\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x1C5B86AA\n\nPrivileges:\t\tSeImpersonatePrivilege","organization":"acme","senderHost":"10.160.18.44","sensitivity":"normal","winlog":{"activity_id":"{72e70134-d9a9-0000-db01-e772a9d9da01}","api":"wineventlog","channel":"Security","computer_name":"NVIPROCPRDWEB01.prdnvi.acmeint.com","event_data":{"PrivilegeList":"SeImpersonatePrivilege","SubjectDomainName":"prdnvi","SubjectLogonId":"0x1c5b86aa","SubjectUserName":"procprd-appuser","SubjectUserSid":"S-1-5-21-855572474-1402847513-2951438033-32165"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":652,"thread":{"id":1116}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":6493972,"task":"Special Logon"}}
This is a syslog message from a product called Symantec Data Loss Prevention by Symantec. The following fields were extracted from the message:
fieldExtractorName: symantec_dlp
messageType: data_loss
productIds: [44]
senderHost: 10.160.18.44
sensitivity: normal
sourceInfo: unknown
streamName: symantec_dlp
tags: ['symantec_dlp', 'data_loss']