<45>Feb 23 12:47:35 j0050fp02-1 IPSSI: Protocol: TCP, SrcIP: 73.242.64.180, OriginalClientIP: ::, DstIP: 59.10.148.233, SrcPort: 49231, DstPort: 4356, TCPFlags: 0x0, IngressInterface: s1p2, IngressZone: PDC2_Internet, DE: Primary Detection Engine (64f951e6-9f47-11e5-bd5f-b27fd67bca13), Policy: acme Access Control Policy, ConnectType: Start, AccessControlRuleName: Unknown, AccessControlRuleAction: Block, AccessControlRuleReason: IP Block, Prefilter Policy: Unknown, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 60, ResponderBytes: 0, DNSResponseType: No Error, Sinkhole: Unknown, SecIntMatchingIP: Destination, IPReputationSICategory: Malware, URLCategory: Unknown, URLReputation: Risk unknown
This is a syslog message from a product called Firepower by Cisco. The following fields were extracted from the message:
senderhost: 172.21.201.94
serverport: 4356
severitylabel: notice
tags: ['rfc3164', 'cisco_firepower', 'anomalous_behavior']
productids: [0]
rulecategory: JCI Access Control Policy
severitycode: 5
sourceinfo: unknown
action: block
localstarttime: Feb 23 12:47:35
sensitivity: normal
rulename: Unknown
program: IPSSI
localhostname: j0050fp02-1
priority: 45
facilitylabel: syslogd
messagetype: anomalous_behavior
clientport: 49231
protocol: 6
facilitycode: 5
clientbytes: 60
streamName: cisco_firepower
clientIP: 73.242.64.180
serverIP: 59.10.148.233