<134>Feb 15 06:22:49 deepsecurity CEF:0|Trend Micro|Deep Security Agent|50.0.1770|1005936|Identified Local File Inclusion (LFI) Over HTTP|10|cn1=36299 cn1Label=Host ID dvc=145.71.190.173 TrendMicroDsTenant=PayGoElectric TrendMicroDsTenantId=24873 dmac=0E:B1:8F:82:89:E5 smac=0E:72:24:48:62:E9 TrendMicroDsFrameType=IP src=57.89.24.137 dst=145.71.190.173 in=537 cs3=DF 0 cs3Label=Fragmentation Bits proto=TCP spt=34846 dpt=80 cs2=ACK PSH cs2Label=TCP Flags cnt=1 act=IDS:Reset cn3=47 cn3Label=DPI Packet Position cs5=15827 cs5Label=DPI Stream Position  cs1="LFI-5" cs1Label=DPI Note cs6=8 cs6Label=DPI Flags
This is a syslog message from a product called Trend Deep Security by Trend Micro. The following fields were extracted from the message:
senderhost: 34.205.5.1
serverport: 80
severitylabel: emergency
tags: ['TCP Flags:ACK PSH', 'DPI Stream Position :15827', 'DPI Note:LFI-5', 'trend micro_deep security agent_Identified Local File Inclusion (LFI) Over HTTP', 'rfc3164', 'Fragmentation Bits:DF 0', 'cef', 'Identified Local File Inclusion (LFI) Over HTTP', 'trend micro_deep security agent', 'DPI Flags:8']
productids: [30]
sourceinfo: unknown
localstarttime: Feb 15 06:22:49
sensitivity: normal
localhostname: deepsecurity
priority: 134
facilitylabel: local0
messagetype: Identified Local File Inclusion (LFI) Over HTTP
servermac: 0EB18F8289E5
clientmac: 0E72244862E9
clientport: 34846
vendorcode: 1005936
action: IDS:Reset
protocol: 6
facilitycode: 16
serverbytes: 537
streamName: trend micro_deep security agent
clientIP: 57.89.24.137
serverIP: 145.71.190.173