<4>Jul 26 09:58:44 OAK-SYM-V01 SymantecServer: GRND0030,Local Host IP: ff02::c,Local Port: 1900,Local Host MAC: 33330000000C,Remote Host IP: fe80::9490:a7:7159:433d,Remote Host Name: ,Remote Port: 57953,Remote Host MAC: 002B6761963F,UDP,Inbound,Begin: 2024-07-26 08:46:47,End Time: 2024-07-26 08:51:55,Occurrences: 238,Application: C:/Windows/System32/svchost.exe,Rule: Block UPnP Discovery,Location: Default,User Name: LOCAL SERVICE,Domain Name: NT AUTHORITY,Action: Blocked,SHA-256: 6fc3bf1fdfd76860be782554f8d25bd32f108db934d70f4253f1e5f23522e503,MD-5: 7469CC568AD6821FD9D925542730A7D8
This is a syslog message from a product called Symantec Endpoint Protection by Symantec. The following fields were extracted from the message:
facilityLabel: kernel
fieldExtractorName: symantec_sep
localHostname: OAK-SYM-V01
localStartTime: Jul 26 09:58:44
messageType: management_message
priority: 4
program: SymantecServer
senderHost: 10.0.1.140
sensitivity: normal
severityCode: 4
severityLabel: warning
sourceInfo: unknown
streamName: symantec_sep
tags: ['rfc3164', 'symantec_sep', 'management_message']