<14>Mar 31 02:15:27 DC1-PA3220-1 1,2023/03/31 02:15:26,016201032964,TRAFFIC,drop,2560,2023/03/31 02:15:26,229.42.60.130,73.187.11.122,0.0.0.0,0.0.0.0,Geo Block Inbound,,,not-applicable,vsys1,Untrust,Untrust,ethernet1/2,,Witfoo Log Forward Only,2023/03/31 02:15:26,0,1,41076,4292,0,0,0x0,tcp,deny,60,60,0,1,2023/03/31 02:15:27,0,any,0,4848414492,0x0,Russian Federation,United States,0,1,0,policy-deny,253,0,0,0,,DC1-PA3220-1,from-policy,,,0,,0,,N/A,0,0,0,0,7ce986cd-09a4-4d62-9f2c-f3f40200a7b6,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2023-03-31T02:15:27.279-07:00,,
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
rulename: Geo Block Inbound
senderhost: 10.99.10.30
serverport: 4292
severitylabel: informational
tags: ['rfc3164', 'pan_firewall', 'traffic_drop']
productids: [20, 0]
severitycode: 6
sourceinfo: unknown
action: block
localstarttime: Mar 31 02:15:27
sensitivity: normal
application: not-applicable
localhostname: DC1-PA3220-1
priority: 14
clientpackets: 1
totalbytes: 60
facilitylabel: user-level
messagetype: traffic_drop
clientport: 41076
protocol: 6
facilitycode: 1
clientbytes: 60
streamName: pan_firewall
clientIP: 229.42.60.130
serverIP: 73.187.11.122