<45>Feb 23 12:47:35 j0050fp02-1 IPSSI: Protocol: TCP, SrcIP: 89.192.127.144, OriginalClientIP: ::, DstIP: 168.102.97.82, SrcPort: 49231, DstPort: 4356, TCPFlags: 0x0, IngressInterface: s1p2, IngressZone: PDC2_Internet, DE: Primary Detection Engine (64f951e6-9f47-11e5-bd5f-b27fd67bca13), Policy: umbrella Access Control Policy, ConnectType: Start, AccessControlRuleName: Unknown, AccessControlRuleAction: Block, AccessControlRuleReason: IP Block, Prefilter Policy: Unknown, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 60, ResponderBytes: 0, DNSResponseType: No Error, Sinkhole: Unknown, SecIntMatchingIP: Destination, IPReputationSICategory: Malware, URLCategory: Unknown, URLReputation: Risk unknown
{
    "senderhost": "172.21.201.94",
    "serverport": 4356,
    "severitylabel": "notice",
    "tags": [
        "rfc3164",
        "cisco_firepower",
        "anomalous_behavior"
    ],
    "productids": [
        0
    ],
    "rulecategory": "JCI Access Control Policy",
    "severitycode": 5,
    "sourceinfo": "unknown",
    "message": "<45>Feb 23 12:47:35 j0050fp02-1 IPSSI: Protocol: TCP, SrcIP: 89.192.127.144, OriginalClientIP: ::, DstIP: 168.102.97.82, SrcPort: 49231, DstPort: 4356, TCPFlags: 0x0, IngressInterface: s1p2, IngressZone: PDC2_Internet, DE: Primary Detection Engine (64f951e6-9f47-11e5-bd5f-b27fd67bca13), Policy: umbrella Access Control Policy, ConnectType: Start, AccessControlRuleName: Unknown, AccessControlRuleAction: Block, AccessControlRuleReason: IP Block, Prefilter Policy: Unknown, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 60, ResponderBytes: 0, DNSResponseType: No Error, Sinkhole: Unknown, SecIntMatchingIP: Destination, IPReputationSICategory: Malware, URLCategory: Unknown, URLReputation: Risk unknown",
    "action": "block",
    "localstarttime": "Feb 23 12:47:35",
    "sensitivity": "normal",
    "rulename": "Unknown",
    "program": "IPSSI",
    "localhostname": "j0050fp02-1",
    "priority": 45,
    "facilitylabel": "syslogd",
    "messagetype": "anomalous_behavior",
    "clientport": 49231,
    "protocol": 6,
    "facilitycode": 5,
    "clientbytes": 60,
    "streamName": "cisco_firepower",
    "clientIP": "89.192.127.144",
    "serverIP": "168.102.97.82"
}