<14>Aug  9 11:09:35 CPB-MV-PA220 1,2022/08/09 11:09:35,012801149812,THREAT,url,2560,2022/08/09 11:09:35,62.111.77.240,36.103.219.196,184.185.112.150,36.103.219.196,IT Users Outbound,,,ssl,vsys1,L3 Trust,L3 Untrust,ethernet1/1,sdwan.901,ForwardToPanorama,2022/08/09 11:09:35,33929,1,55566,443,18864,443,0x403400,tcp,block-url,"beap.gemini.yahoo.com/",(9999),web-advertisements,informational,client-to-server,31001478,0xa000000000000000,10.0.0.0-10.255.255.255,United States,0,,0,,,0,,,,,,,,0,27,109,0,0,,CPB-MV-PA220,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,,"web-advertisements,low-risk",065bc8bd-1c6f-4c23-9eb0-21f59a597833,0,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2022-08-09T11:09:35.801-07:00,,,
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
rulename: IT Users Outbound
senderhost: 10.87.11.11
serverport: 443
severitylabel: informational
tags: ['CPB-MV-PA220', 'rfc3164', 'pan_firewall', 'firewall_log', '(9999)', 'ssl']
productids: [20, 0]
rulecategory: unknown
severitycode: 6
sourceinfo: unknown
action: block
localstarttime: 2022/08/09 11:09:35
sensitivity: normal
localhostname: CPB-MV-PA220
priority: 14
facilitylabel: user-level
messagetype: firewall_log
clientport: 55566
protocol: 6
facilitycode: 1
streamName: pan_firewall
clientIP: 62.111.77.240
serverIP: 36.103.219.196