<14>Mar 18 11:03:35 CPB-LJ-PA220.SDPB.LOCAL 1,2024/03/18 11:03:35,012801149901,THREAT,url,2562,2024/03/18 11:03:35,86.205.151.114,101.116.135.200,207.114.222.230,101.116.135.200,IT Users Outbound,,,ssl,vsys1,L3 Trust,L3 Untrust,ethernet1/1,sdwan.901,ForwardToPanorama,2024/03/18 11:03:35,10843,1,49858,443,34893,443,0x403400,tcp,block-url,"x.bidswitch.net/",9999(9999),web-advertisements,informational,client-to-server,7344415838759888585,0x8000000000000000,10.0.0.0-10.255.255.255,United States,,,0,,,0,,,,,,,,0,27,95,0,0,,CPB-LJ-PA220,,,,,0,,0,,N/A,N/A,AppThreat-0-0,0x0,0,4294967295,,"web-advertisements,low-risk",f8df782e-4140-4788-9ec2-ce1bd916b7c7,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2024-03-18T11:03:35.583-07:00,,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
action: block
clientport: 49858
facilitycode: 1
facilitylabel: user-level
localhostname: CPB-LJ-PA220.SDPB.LOCAL
localstarttime: 2024/03/18 11:03:35
messagetype: firewall_log
priority: 14
protocol: 6
rulecategory: N/A
rulename: IT Users Outbound
senderhost: 10.87.2.11
sensitivity: normal
serverport: 443
severitycode: 6
severitylabel: informational
sourceinfo: unknown
tags: ['ssl', 'rfc3164', 'pan_firewall', '9999(9999)', 'CPB-LJ-PA220', 'firewall_log']
streamName: pan_firewall
clientIP: 86.205.151.114
serverIP: 101.116.135.200