V 2.0 : EVID 5156 : WFP - Connection Permitted

Rule Name

Rule Type

Common Event

Classification

V 2.0 : EVID 5156 : WFP - Connection Permitted

Base Rule

Traffic Allowed by Host Firewall

Network Allow

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

The version number of the event's definition.

Level

<severity>

String/Number/Text

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

N/A

N/A

The name of the computer on which the event occurred.

ProcessId

<processid>

Text/String/ Number

hexadecimal Process ID of the process which received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process.

Application

<process>

Text/String

full path and the name of the executable for the process.

Direction

N/A

N/A

direction of allowed connection.
Inbound – for inbound connections.
Outbound – for unbound connections.

SourceAddress

<sip>

Ip Address

IP address from which the connection was initiated.
IPv4 Address
IPv6 Address
:: - all IP addresses in IPv6 format
0.0.0.0 - all IP addresses in IPv4 format
127.0.0.1 , ::1 - localhost

SourcePort

<sport>

Number

port number from which the connection was initiated.

DestAddress

<dip>

Ip Address

IP address where the connection was received.
IPv4 Address
IPv6 Address
:: - all IP addresses in IPv6 format
0.0.0.0 - all IP addresses in IPv4 format
127.0.0.1 , ::1 - localhost

DestPort

<dport>

Number

port number where the connection was received.

Protocol

<protnum>

Number

number of protocol which was used.

FilterRTID

N/A

N/A

unique filter ID which allowed the connection.

LayerName

N/A

N/A

Application Layer Enforcement layer name.

LayerRTID

N/A

N/A

Windows Filtering Platform layer identifier.