<14>Aug  9 11:10:09 CPB-SD-PA220 1,2022/08/09 11:10:08,012801150092,THREAT,url,2560,2022/08/09 11:10:08,191.39.214.34,166.6.127.19,70.183.89.110,166.6.127.19,IT Users Outbound,,,facebook-base,vsys1,L3 Trust,L3 Untrust,ethernet1/1,sdwan.901,ForwardToPanorama,2022/08/09 11:10:08,42832,1,56152,443,2823,443,0x403400,tcp,block-url,"connect.facebook.net/",(9999),acmeial-networking,informational,client-to-server,35757965,0xa000000000000000,10.0.0.0-10.255.255.255,United States,0,,0,,,0,,,,,,,,0,27,137,0,0,,CPB-SD-PA220,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,,"acmeial-networking,low-risk",065bc8bd-1c6f-4c23-9eb0-21f59a597833,0,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2022-08-09T11:10:09.358-07:00,,,
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
rulename: IT Users Outbound
senderhost: 10.87.5.11
serverport: 443
severitylabel: informational
tags: ['(9999)', 'rfc3164', 'pan_firewall', 'CPB-SD-PA220', 'facebook-base', 'firewall_log']
productids: [20, 0]
rulecategory: unknown
severitycode: 6
sourceinfo: unknown
action: block
localstarttime: 2022/08/09 11:10:08
sensitivity: normal
localhostname: CPB-SD-PA220
priority: 14
facilitylabel: user-level
messagetype: firewall_log
clientport: 56152
protocol: 6
facilitycode: 1
streamName: pan_firewall
clientIP: 191.39.214.34
serverIP: 166.6.127.19