<2>Jul 27 00:33:10 OAK-SYM-V01 SymantecServer: OAK-GP-SQLD2,Local Host IP: 224.0.0.252,Local Port: 5355,Local Host MAC: 01005E0000FC,Remote Host IP: 10.0.1.225,Remote Host Name: oak-sql-gp2.oscorp.net,Remote Port: 50095,Remote Host MAC: 005056B892FC,UDP,Inbound,Begin: 2024-07-27 00:11:57,End Time: 2024-07-27 00:11:57,Occurrences: 1,Application: C:/Windows/System32/svchost.exe,Rule: Allow Ipv4 LLMNR from private IP addresses,Location: Default,User Name: NETWORK SERVICE,Domain Name: NT AUTHORITY,Action: Allowed,SHA-256: 7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6,MD-5: 8A0A29438052FAED8A2532DA50455756
This is a syslog message from a product called Symantec Endpoint Protection by Symantec. The following fields were extracted from the message:
facilityLabel: kernel
fieldExtractorName: symantec_sep
localHostname: OAK-SYM-V01
localStartTime: Jul 27 00:33:10
messageType: management_message
priority: 2
program: SymantecServer
senderHost: 10.0.1.140
sensitivity: normal
severityCode: 2
severityLabel: critical
sourceInfo: unknown
streamName: symantec_sep
tags: ['rfc3164', 'symantec_sep', 'management_message']