<185>Jun 16 17:19:18 WAFirewall CEF:0|Barracuda|WAF|1220|342|GEO_IP_BLOCK|1|cat=WF dst=127.226.219.42 dpt=443 act=DENY msg=[Fake Crawler] duser="-" src=26.33.127.199 spt=47010 requestMethod=GET app=TLSv1.3 requestContext="-" start=Jun 16 2024 17:19:18  rt=1718576358675  request=/servlet/eAndar.WebImage requestClientApplication="facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" dvchost=WAFirewall externalId=190232224bc-f9da46e cn2=47010 cn2Label=ProxyPort cs1=global cs1Label=RuleID cs2=NONE cs2Label=FollowUpAction cs3=GLOBAL cs3Label=RuleType cs4=Forceful Browsing cs4Label=AttackGroup cs5=26.33.127.199 cs5Label=ProxyIP cs6="-" cs6Label=SessionID 

This is a syslog message from a product called Barracuda WAF by Barracuda. The following fields were extracted from the message:
action: block
clientport: 47010
facilitycode: 23
facilitylabel: local7
fqdn: /servlet/eAndar.WebImage
localhostname: WAFirewall
localstarttime: 1718576358675 
messagetype: GEO_IP_BLOCK
priority: 185
senderhost: 10.0.0.250
sensitivity: normal
serverport: 443
severitycode: 9
severitylabel: alert
sourceinfo: unknown
tags: ['RuleID:global', 'barracuda_waf_GEO_IP_BLOCK', 'ProxyIP:173.252.95.5', 'AttackGroup:Forceful Browsing', 'RuleType:GLOBAL', 'barracuda_waf', 'rfc3164', 'GEO_IP_BLOCK', 'cef', 'SessionID:-', 'FollowUpAction:NONE']
vendorcode: 342
streamName: barracuda_waf
clientIP: 26.33.127.199
serverIP: 127.226.219.42
userName: -