{"actor": {"id": "00uffks4r9kkYNxpj5d7", "type": "User", "alternateId": "user15@splunkresearch.com", "displayName": "user15", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36", "os": "Mac OS 11.3.1 (Sonoma)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": null, "ipAddress": "120.1.121.43", "geographicalContext": {"city": "Ohio", "state": "Ohio", "country": "United States", "postalCode": "10065", "geolocation": {"lat": 20.7652, "lon": -22.9588}}}, "device": null, "authenticationContext": {"authenticationProvider": null, "credentialProvider": null, "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "trsDTWgT1AlTM2Dai7IRY7cHQ"}, "displayMessage": "User report suspicious activity", "eventType": "user.account.report_suspicious_activity_by_enduser", "outcome": {"result": "SUCCESS", "reason": null}, "published": "2024-03-11T16:28:40.048Z", "securityContext": {"asNumber": 12271, "asOrg": "twc internal spectrum", "isp": "charter communications inc", "domain": "rr.com", "isProxy": false}, "severity": "WARN", "debugContext": {"debugData": {"suspiciousActivityEventCountry": "United States", "suspiciousActivityBrowser": "CHROME", "suspiciousActivityEventId": "5e2fd100-dfc4-11ee-be83-538191b64b24", "suspiciousActivityEventState": "Ohio", "suspiciousActivityTimestamp": "2024-03-11T16:28:18.184Z", "requestUri": "/api/internal/users/me/report-suspicious-activity", "suspiciousActivityOs": "Mac OS 14.3.1 (Sonoma)", "suspiciousActivityEventLatitude": "20.7652", "suspiciousActivityEventTransactionId": "5e32024c5d1d1ed06a7d7d7bcce98d24", "url": "/api/internal/users/me/report-suspicious-activity?i=eyJ6aXAiOiJERUYiLCJ2ZXIiOiIxIiwiZW5jIjoiQTI1NkdDTSIsImFsZyI6ImRpciJ9..N4VnjtqD-5DEU_Xh.lDDuo-Ak7-hWUfYZjZr-_PyDRlTkWLPw-5-S1_M_bOW5nXW7Bu0SktJ2pemriffy0qbUhTeXVa3EQtqzJjp0mocvdMbFBmkoHFy1kCEt44374CA7TaQs6AXc7LDz_ru9Htuo3K7j1x-Fqe3tYE-6g8AeI8Wp_YeIO689GPK3NYoqBOuiz3K_-d7nTg5NaNTeSBVEvNnCMfPRHB8H.Jwqfs1N8dgNHKiNTVz81KA", "requestId": "7384c77ab3f9c184976fad42f1369213", "dtHash": "46cdb4e9a86702a418888c7527035133bda72a6a661123a480afe34713b8309c", "suspiciousActivityEventCity": "Ohio", "suspiciousActivityEventLongitude": "-20.9588", "suspiciousActivityEventIp": "120.1.121.43", "suspiciousActivityEventType": "system.email.mfa_reset_notification.sent_message"}}, "legacyEventType": "core.user.account.report_suspicious_activity_by_enduser", "transaction": {"type": "WEB", "id": "7384c77ab3f9c184976fad42f1369213", "detail": {}}, "uuid": "6b37ffcf-dfc4-11ee-aa5e-573f33f244ef", "version": "0", "request": {"ipChain": [{"ip": "120.1.121.43", "geographicalContext": {"city": "Ohio", "state": "Ohio", "country": "United States", "postalCode": "10065", "geolocation": {"lat": 40.7652, "lon": -73.9588}}, "version": "V4", "source": null}]}, "target": [{"id": "00uffks4r9kkYNxpj5d7", "type": "User", "alternateId": "user15@splunkresearch.com", "displayName": "user15 2 V", "detailEntry": null}]}