Getting frequent intrusion blocks typically as follows:
RiskName: PortScan
Traffic Description: UDP, port 5355
Attacking & Destination computers are identified with a 4-place hex prefix, double colon, followed by four colon-delimited 4-place hex strings, a comma, and a 5-6 decimal number (port number?).
What the heck are those identifiers?