<14>Apr 27 12:51:02 DC1-PA3220-1 1,2023/04/27 12:51:01,016201032964,TRAFFIC,drop,2560,2023/04/27 12:51:01,239.141.105.244,193.22.130.146,0.0.0.0,0.0.0.0,Geo Block Inbound,,,not-applicable,vsys1,Untrust,Untrust,ethernet1/13,,Witfoo Log Forward Only,2023/04/27 12:51:01,0,1,36894,57150,0,0,0x0,tcp,deny,66,66,0,1,2023/04/27 12:51:01,0,any,0,5135915747,0x0,Russian Federation,United States,0,1,0,policy-deny,253,0,0,0,,DC1-PA3220-1,from-policy,,,0,,0,,N/A,0,0,0,0,7ce986cd-09a4-4d62-9f2c-f3f40200a7b6,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2023-04-27T12:51:02.875-07:00,,
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
action: block
application: not-applicable
clientport: 57150
facilitycode: 1
facilitylabel: user-level
localhostname: DC1-PA3220-1
localstarttime: Apr 27 12:51:02
messagetype: traffic_drop
priority: 14
protocol: 6
rulename: Geo Block Inbound
senderhost: 10.99.10.30
sensitivity: normal
serverbytes: 66
serverpackets: 1
serverport: 36894
severitycode: 6
severitylabel: informational
sourceinfo: unknown
tags: ['rfc3164', 'pan_firewall', 'traffic_drop']
totalbytes: 66
streamName: pan_firewall
clientIP: 193.22.130.146
serverIP: 239.141.105.244