WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-26T16:44:24.789Z","agent":{"ephemeral_id":"2684bcd2-4a2b-4981-9139-d620c6b2af92","id":"a5def5dd-6173-4dfd-bc91-3ca20122db53","name":"Nordc-APP-ADFS1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"code":"1200","created":"2024-07-26T16:44:26.307Z","kind":"event","outcome":"success","provider":"AD FS Auditing"},"host":{"name":"Nordc-APP-ADFS1.stark.com"},"log":{"level":"information"},"message":"The Federation Service issued a valid token. See XML for details. \n\nActivity ID: 77ad3e8b-8c37-457e-80e0-82bff43773a4 \n\nAdditional Data \nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\n  <AuditType>AppToken</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>John Drennan III</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>true</MfaPerformed>\n      <MfaMethod>MFA</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>TokenUnbound</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.stark.com/adfs/services/trust</Server>\n      <AuthProtocol>WSFederation</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>172.16.100.9</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0</UserAgentString>\n      <Endpoint>/adfs/ls/</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>","organization":"stark","senderHost":"192.168.10.55","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"Nordc-APP-ADFS1.stark.com","event_data":{"param1":"77ad3e8b-8c37-457e-80e0-82bff43773a4","param2":"<?xml version=\"1.0\" encoding=\"utf-16\"?>\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\n  <AuditType>AppToken</AuditType>\n  <AuditResult>Success</AuditResult>\n  <FailureType>None</FailureType>\n  <ErrorCode>N/A</ErrorCode>\n  <ContextComponents>\n    <Component xsi:type=\"ResourceAuditComponent\">\n      <RelyingParty>urn:federation:MicrosoftOnline</RelyingParty>\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\n      <UserId>John Drennan III</UserId>\n    </Component>\n    <Component xsi:type=\"AuthNAuditComponent\">\n      <PrimaryAuth>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</PrimaryAuth>\n      <DeviceAuth>false</DeviceAuth>\n      <DeviceId>N/A</DeviceId>\n      <MfaPerformed>true</MfaPerformed>\n      <MfaMethod>MFA</MfaMethod>\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\n      <TokenBindingReferredId>false</TokenBindingReferredId>\n      <SsoBindingValidationLevel>TokenUnbound</SsoBindingValidationLevel>\n    </Component>\n    <Component xsi:type=\"ProtocolAuditComponent\">\n      <OAuthClientId>N/A</OAuthClientId>\n      <OAuthGrant>N/A</OAuthGrant>\n    </Component>\n    <Component xsi:type=\"RequestAuditComponent\">\n      <Server>http://adfs.stark.com/adfs/services/trust</Server>\n      <AuthProtocol>WSFederation</AuthProtocol>\n      <NetworkLocation>Intranet</NetworkLocation>\n      <IpAddress>172.16.100.9</IpAddress>\n      <ForwardedIpAddress />\n      <ProxyIpAddress>N/A</ProxyIpAddress>\n      <NetworkIpAddress>N/A</NetworkIpAddress>\n      <ProxyServer>N/A</ProxyServer>\n      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0</UserAgentString>\n      <Endpoint>/adfs/ls/</Endpoint>\n    </Component>\n  </ContextComponents>\n</AuditBase>"},"event_id":"1200","keywords":["Classic","Audit Success"],"provider_name":"AD FS Auditing","record_id":1388136816,"user":{"domain":"MDS-ATL","identifier":"S-1-5-21-1725571127-999974082-2044928816-27902","name":"adfs","type":"User"}}}
Product: ad fs auditing
Vendor: ad fs auditing