@carlos-magalhaes

The 119,4,1 fields are GID (Generator ID), SID (Signature ID) and Revision, respectively.

The msg field is the text description of what the rule does or detects. It will have quotation marks around it in the log file to make sure any embedded commas in text are not interpreted as field delimiters.

Protocol is self-explanatory.

You have Source IP and port, then destination IP and port.

The item field escapes my memory at the moment. I will have to look it up.

Next are two custom fields added by pfSense: Classification and Priority.